JWT | MQL Functions | MentDB Weak

JWT

jwt sign jwt sign jwt verify jwt verify jwt decode

jwt sign <json_claims> <key>

Description

Sign claims with a secret (HS256)

Parameters

json_claims: The claims - String - required
key: The secret (32 bytes or more for HS256) or a PEM private key - String - required

admin
jwt sign "{\"sub\": \"user-42\", \"role\": \"admin\"}" "change-me-to-a-secret-of-32-bytes-or-more"

mentdb
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiAidXNlci00MiIsICJyb2xlIjogImFkbWluIn0.o8o76gGVeDNe1d0sKKo0cBeXihK6W7sz1dO7NJOdu4g

jwt sign <json_claims> <key> <json_params>

Description

Sign with parameters: alg (HS256 for a secret, RS256 for an RSA key, ES256 / ES384 for an EC key), expires_in (seconds: adds iat and exp), kid, typ (JWT), headers (other header fields), now (the current time in seconds, for tests)

Parameters

json_claims: The claims - String - required
key: The secret or the PEM private key - String - required
json_params: The parameters - String - required

admin
jwt sign "{\"sub\": \"user-42\", \"aud\": \"orders-api\"}" "change-me-to-a-secret-of-32-bytes-or-more" "{\"expires_in\": 3600, \"kid\": \"api\", \"now\": 1793750400}"

mentdb
eyJraWQiOiJhcGkiLCJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiAidXNlci00MiIsICJhdWQiOiAib3JkZXJzLWFwaSIsICJpYXQiOiAxNzkzNzUwNDAwLCAiZXhwIjogMTc5Mzc1NDAwMH0.hlg7TMST0nTJI84oVnBv2pv3iJtdT1ho4Ig6FOeBFZo

Used in use cases (1 recipe)

API & database integrator › Secure an internal API: sign a JWT, verify it, and see why a token is refused

Often used with

jwt decode · jwt verify

jwt verify <token> <key>

Description

Verify a token: valid, the error if not valid, the header and the claims

Parameters

token: The token (a "Bearer " prefix is accepted) - String - required
key: The secret, the PEM public key or certificate, a JWK or a JWKS - String - required

admin
jwt verify "eyJraWQiOiIyMDI2LTExIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiAib3JkZXItc2VydmljZSIsICJzY29wZSI6ICJvcmRlcnM6cmVhZCIsICJpc3MiOiAiaHR0cHM6Ly9hdXRoLmV4YW1wbGUuY29tIn0.h6H-CTmF1Gmy3rTfxr_DnrMs0w8B0OQ-H4LZhH5vK-0HxfuMlQmRJXRKFlJC2YTsbpKYr4V-Mptsa6wBstAbOoKgYTfJORFU4fJEAJFXbtNjg8Mz4AGZo9vD2fjLFpBp6UlthvVTiI62osVCsWe4jvtAL_vzc6zH4m4Yaz0DNMyCddAQH0ST3k-tqbTyylRDcXjtmB84pLqUQ6hHUnF6MNJN8E0Hbgu6z7xiC_4QcyzsoH2vnvUVprmO98hOxnbm1zeUN2dmJ9nY91ItuIQPwlDZGvalXCBTcyjNerLP2ogg30QnxXo5UNhX8Xg9Nbs1qPdE9f24tK_Opsvbx-giOg" "-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkCd0Y8aFSldc50Dpa/p2
G+NwRWb4A7FPAzHAdOTuFM15cyO4zCGDb5uUZRtmIJgHFk55/pJ/WwCAgt0v7jWs
/aVL53eaL1SNuv488d7aQvKnIWwXk/4KZz4FDdtnDEgUa/+St0pCOZoanmJBnNvk
7KTOj3DJOU6rFOjz6K87U/G86GIAt6yc5gaIxYDxPeP0pFiJk4jDLR3KSRkJIOt0
+dQkH4FCghJEYkcPiw5mrowjeQ3nVmlhtNIdlxOSGQn+txTerJZEeopzKplxpf83
Y4rdWbIJ7YQXJtjn1A63cjcM8Fu9u7ETIcDhUv8wS57CZNkBTrZGPi+eMbeGa4Iu
WwIDAQAB
-----END PUBLIC KEY-----
"

mentdb
{"valid": true, "error": null, "header": {"kid": "2026-11", "typ": "JWT", "alg": "RS256"}, "claims": {"sub": "order-service", "scope": "orders:read", "iss": "https://auth.example.com"}}

jwt verify <token> <key> <json_params>

Description

Verify with parameters: alg (the expected algorithm), issuer, audience, subject, require_exp (false: true refuses a token without exp), leeway (60 seconds), now (the current time in seconds, for tests)

Parameters

token: The token - String - required
key: The key - String - required
json_params: The parameters - String - required

admin
jwt verify "eyJraWQiOiJhcGkiLCJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiAidXNlci00MiIsICJhdWQiOiAib3JkZXJzLWFwaSIsICJpYXQiOiAxNzkzNzUwNDAwLCAiZXhwIjogMTc5Mzc1NDAwMH0.hlg7TMST0nTJI84oVnBv2pv3iJtdT1ho4Ig6FOeBFZo" "change-me-to-a-secret-of-32-bytes-or-more" "{\"now\": 1793760000}"

mentdb
{"valid": false, "error": "the token expired at 1793754000 (now 1793760000)", "header": {"kid": "api", "typ": "JWT", "alg": "HS256"}, "claims": {"sub": "user-42", "aud": "orders-api", "iat": 1793750400, "exp": 1793754000}}

Wrong audience

admin
jwt verify "eyJraWQiOiJhcGkiLCJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiAidXNlci00MiIsICJhdWQiOiAib3JkZXJzLWFwaSIsICJpYXQiOiAxNzkzNzUwNDAwLCAiZXhwIjogMTc5Mzc1NDAwMH0.hlg7TMST0nTJI84oVnBv2pv3iJtdT1ho4Ig6FOeBFZo" "change-me-to-a-secret-of-32-bytes-or-more" "{\"audience\": \"billing-api\", \"now\": 1793751000}"

mentdb
{"valid": false, "error": "the audience 'billing-api' is not in the token (aud: orders-api)", "header": {"kid": "api", "typ": "JWT", "alg": "HS256"}, "claims": {"sub": "user-42", "aud": "orders-api", "iat": 1793750400, "exp": 1793754000}}

Used in use cases (1 recipe)

API & database integrator › Secure an internal API: sign a JWT, verify it, and see why a token is refused

Often used with

jwt decode · jwt sign

jwt decode <token>

Description

Read the header and the claims of a token WITHOUT verifying its signature (never use it to trust a token: use jwt verify)

Parameters

token: The token - String - required

admin
jwt decode "eyJraWQiOiIyMDI2LTExIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiAib3JkZXItc2VydmljZSIsICJzY29wZSI6ICJvcmRlcnM6cmVhZCIsICJpc3MiOiAiaHR0cHM6Ly9hdXRoLmV4YW1wbGUuY29tIn0.h6H-CTmF1Gmy3rTfxr_DnrMs0w8B0OQ-H4LZhH5vK-0HxfuMlQmRJXRKFlJC2YTsbpKYr4V-Mptsa6wBstAbOoKgYTfJORFU4fJEAJFXbtNjg8Mz4AGZo9vD2fjLFpBp6UlthvVTiI62osVCsWe4jvtAL_vzc6zH4m4Yaz0DNMyCddAQH0ST3k-tqbTyylRDcXjtmB84pLqUQ6hHUnF6MNJN8E0Hbgu6z7xiC_4QcyzsoH2vnvUVprmO98hOxnbm1zeUN2dmJ9nY91ItuIQPwlDZGvalXCBTcyjNerLP2ogg30QnxXo5UNhX8Xg9Nbs1qPdE9f24tK_Opsvbx-giOg"

mentdb
{"header": {"kid": "2026-11", "typ": "JWT", "alg": "RS256"}, "claims": {"sub": "order-service", "scope": "orders:read", "iss": "https://auth.example.com"}, "signed": true, "verified": false}

Used in use cases (1 recipe)

API & database integrator › Secure an internal API: sign a JWT, verify it, and see why a token is refused

Often used with

jwt sign · jwt verify