Inspect API Tokens While Testing Endpoints

Decode JWTs returned by your API to verify the right claims, scopes, and permissions are being issued.

无需登录

JWT Token

🔒 The token is decoded entirely in your browser. Nothing is sent to any server.

API Testing tips

🔌

After hitting your /auth/login endpoint in Postman or curl, paste the returned token here to verify the user role, scopes, and expiration look correct.

💡

For OAuth integrations: paste the access token to see the granted `scope` claim. Mismatches between requested and granted scopes cause silent permission failures.

📋

Use the "Copy JSON" button to copy the payload and paste it into your API documentation as an example of what the token contains.

🔍

The standard claims explained section helps API consumers understand what fields like `iss`, `sub`, `aud` actually mean in the OAuth/OIDC specs.