JWT n8n INTEGRATION: AUTOMATE JWT WITH N8N

The Sign action is your go-to for generating fresh JSON Web Tokens on demand. Whenever your workflow needs to issue an access token, create a session identifier, or generate a secure payload for inter-service communication, this action handles the cryptographic heavy lifting while you focus on the logic.

Key parameters: Credential to connect with is a required dropdown where you select your pre-configured JWT Auth account containing the signing secret or private key. This ensures consistent and secure token generation across all your workflows. Operation is set to "Sign" to indicate the node will create a new signed token rather than verify or decode an existing one. Use JSON to Build Payload is an optional toggle that lets you choose between entering raw JSON for complex payloads or using the manual claim entry method for simpler tokens. Turn it on when you have dynamic JSON from previous nodes. Payload Claims is an expandable section where you add key-value pairs that become the token's payload. Click "Add Claim" to include standard claims like sub (subject), exp (expiration), iat (issued at), or any custom claims your application requires. Options are advanced parameters for specifying additional JWT header values, custom algorithms, or other signing options when your use case demands fine-tuned control.

Use cases: Generate access tokens automatically when users complete registration via a webhook, create short-lived tokens for secure file download links that expire after one use, issue refresh tokens during authentication flows and store them in your Supabase database, or sign service-to-service communication tokens for microservices architectures.

The Verify action acts as your security gatekeeper, checking whether incoming JWT tokens are authentic and untampered. Before your workflow processes sensitive operations—granting access, returning data, or triggering downstream actions—this node ensures the token was legitimately signed with your secret and hasn't been modified.

Key parameters: Credential to connect with is a required dropdown to select the JWT Auth account containing the secret or public key used for verification. The key must match what was used to sign the original token. Operation is set to "Verify" to instruct the node to validate the token's signature and integrity rather than generate or decode. Token is a required text field where you input the JWT string to verify. This typically comes from a previous node—perhaps extracted from an HTTP header, webhook payload, or database record. Options is an expandable section for advanced verification parameters. Here you can specify expected algorithms (to prevent algorithm confusion attacks), required claims, or custom verification rules depending on your security requirements.

Use cases: Validate bearer tokens from incoming API requests before processing the payload, check session tokens before allowing users to access protected resources, verify webhook signatures to ensure requests genuinely originate from trusted sources, or gate conditional workflow branches based on token validity (valid → proceed, invalid → reject).

The Decode action extracts the payload data from a JWT token without performing signature verification. This is particularly useful when you need to inspect token contents, route workflows based on claims, or debug authentication issues—situations where you trust the token's origin or verification happens elsewhere.

Key parameters: Credential to connect with is a dropdown to select your JWT Auth account. While decoding doesn't require the secret for cryptographic operations, the credential ensures consistent configuration across your JWT nodes. Operation is set to "Decode" to extract the token's header and payload as readable JSON, making the claims accessible for subsequent workflow nodes. Token is a required text input field for the JWT string you want to decode. Paste the token directly or reference it dynamically from previous nodes using expressions like {{ $json.token }}. Options are additional parameters for extended configuration. Though decoding is straightforward, options may include output formatting preferences or handling of specific claim types.

Use cases: Extract user IDs from tokens to look up profiles in your CRM or database, read expiration claims to trigger token refresh flows before they expire, route workflows conditionally based on user roles or permissions embedded in the payload, or debug authentication issues by inspecting token contents during development. For more advanced scenarios, consider combining with OpenAI integrations for AI-powered token analysis.