Read a JWT header and payload for troubleshooting while remembering that decoding never validates the signature.
Before you start
Work on a copy or a controlled test when the change can affect production. Keep timestamps, screenshots and the previous configuration so the result can be compared.
Step by step
- Remove or mask the token from public tickets and screenshots.
- Paste the JWT into the BAOI JWT Decoder, which runs locally.
- Check alg, kid, iss, aud, exp, nbf, and relevant claims.
- Compare issuer and audience with the application configuration.
- For any security decision, cryptographically verify the signature in the application.
Validation
Repeat the original test after the change and confirm that the expected service works without creating a new regression. Document the final state.