JWT Connector

What this connector is for

Signs, decodes, and verifies JSON Web Tokens as a workflow step — e.g. to create a token another API expects, or to check one you received. All signing/verification here is HMAC-based (HS256/HS384/HS512) with a shared secret.

This is a separate feature from a route's own Requires Auth: JWT option, which verifies an incoming request's bearer token before the workflow even starts (also HMAC HS256/HS384/HS512, coincidentally the same algorithm set, but unrelated code and unrelated configuration) — that one gates access to a route; this connector's actions are ordinary steps you place anywhere in a route's own logic.

Generate JWT

Configuring it

• Secret — required, at least 8 characters. The shared secret used to sign the token. Use a workflow variable (e.g. {{variables.secretKey}}) rather than typing a real secret directly into the step.
• Payload — required. A JSON object of claims (e.g. sub, custom claims). Can be typed as a JSON string or a native object — either is accepted.
• Expiration Time — optional, e.g. 1h, 7d, 30m, 365d. Leave empty for a token that never expires. Ignored (with a logged warning, not an error) if Payload already includes its own exp claim.
• Algorithm — HS256 (default), HS384, or HS512.

Reading the response

• {{<stepReference>.response.data.token}} — the signed JWT string.
• {{<stepReference>.response.data.payload}} — the final payload actually encoded (includes exp if one was set).
• {{<stepReference>.response.data.expiresAt}} — an ISO timestamp, present only if the token has an expiration (from Expiration Time or an exp already in Payload).

For example, a step named "Sign Partner Token" (reference signPartnerToken) — use {{signPartnerToken.response.data.token}} as a bearer token in a later HTTP Connector step's Authorization header.

Example

Secret: {{variables.partnerJwtSecret}}
Payload: {"sub": "{{trigger.body.userId}}", "role": "customer"}
Expiration Time: 1h
Algorithm: HS256

Decode JWT

Extracts a token's header and payload without verifying its signature — no secret needed, so don't use this to authenticate anything; it only inspects a token's contents. If the token string isn't a well-formed JWT at all, this step fails (throws), it does not return a structured "invalid" result — see Verify JWT below for that.

Configuring it

• JWT Token — required. The token string to decode.
• Complete Decode — default true: returns both header and payload. Set false to get only the payload (and {{<stepReference>.response.data.header}} is then absent entirely, not just empty).

Reading the response

• {{<stepReference>.response.data.payload}} — the decoded claims.
• {{<stepReference>.response.data.header}} — the decoded header (algorithm, type), present only when Complete Decode is true.
• {{<stepReference>.response.data.expiresAt}} / .issuedAt}} — ISO timestamps derived from the payload's exp/iat, present only if those claims exist.

For example, a step named "Inspect Incoming Token" (reference inspectIncomingToken) — {{inspectIncomingToken.response.data.payload.sub}}.

Example

JWT Token: {{trigger.headers.authorization}}
Complete Decode: true

Verify JWT

Verifies a token's signature and expiration against a secret. Unlike Decode JWT, a bad signature, expired token, or algorithm mismatch does not fail this step — it returns {{<stepReference>.response.data.valid}} = false with an error message, so the workflow can branch on it (e.g. with a Condition step) instead of the whole route failing.

Configuring it

• JWT Token — required. The token to verify.
• Secret — required. Must be the same secret the token was signed with.
• Allowed Algorithms — a comma-separated list, e.g. HS256,HS384,HS512 (the default — all three accepted). Narrow this to the exact algorithm you actually sign with if you want verification to reject a token signed with a different (even if nominally allowed) HMAC strength.

Reading the response

• {{<stepReference>.response.data.valid}} — true or false.
• {{<stepReference>.response.data.payload}} — the verified claims, only when valid is true (null otherwise).
• {{<stepReference>.response.data.header}} — the token's header, only when valid is true.
• {{<stepReference>.response.data.expiresAt}} / .issuedAt}} — ISO timestamps, present only when valid is true and the corresponding claim exists.
• {{<stepReference>.response.data.error}} — present only when valid is false (e.g. "jwt expired", "invalid signature").

For example, a step named "Verify Partner Token" (reference verifyPartnerToken) — branch a later Condition step on {{verifyPartnerToken.response.data.valid}}, and read {{verifyPartnerToken.response.data.payload.sub}} only once you know it's true.

Example

JWT Token: {{trigger.headers.authorization}}
Secret: {{variables.partnerJwtSecret}}
Allowed Algorithms: HS256