idp-debug-jwt

Run the bundled inspect-token.mjs script with the token as an argument. It decodes the header and payload, fetches the live JWKS, matches the kid, verifies the RS256 signature, and checks iss, aud, and exp, printing a labeled verdict for each possible failure.

A missing kid is usually a timing issue: the Resource Server cached the JWKS before a key rotation, or the token was signed by a key already retired from the set. Force a JWKS refresh by restarting the server or clearing its cache, since the IDP serves Cache-Control max-age=3600.

The Overlens IDP signs only with RS256, so an HS256 token is either forged via an algorithm-confusion attack or issued by a misconfigured non-Overlens issuer. A correct Resource Server pins algorithms to ['RS256'] and rejects such tokens outright.

When the signature verifies, the failure is in claim validation, not cryptography. Check that iss matches your JWT_ISSUER, that your expected audience appears in the token's aud array, that exp has not passed, and that the verifier pins RS256.

No. The script is zero-dependency and runs on Node.js 18 or later, using only the built-in fetch API and node:crypto to construct the public key from the JWK and verify the RSA-SHA256 signature.

Use this skill when you have an existing token or JWKS response that misbehaves and need to explain why. If you are implementing JWT validation in a Resource Server from scratch, use the idp-validate-token skill instead.