ToolsDashboard

debug bearer token from api request

Debug a bearer token copied from a failed API request

Inspect the token attached to a 401 or 403 response and compare its claims with what the API expected.

When an API request fails, teams often need to know whether the wrong token was sent, whether the claims are stale, or whether the verifier is misconfigured.

Open the tool Expected result

How to use it

Step 1

Extract the bearer token cleanly

Remove the header prefix and keep only the token string.

Step 2

Inspect header and payload

Review alg, aud, iss, scopes, and time claims side by side.

Step 3

Compare with the API contract

Check whether the request used the right issuer, audience, or role claims.

Sample input

Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJhcGkifQ.signature

Expected result

You can quickly tell whether the 401 came from the token itself or from separate API-side validation logic.

Common mistakes

Leaving the `Bearer` prefix in the parser input.
Comparing against outdated audience values.
Sharing full tokens in bug reports without redaction.

Related workflows

Check whether a JWT is expired or not yet valid

Guide

Inspect custom JWT claims before changing auth rules

Guide

Related tools

ToolsDashboard

debug bearer token from api request

Debug a bearer token copied from a failed API request

Inspect the token attached to a 401 or 403 response and compare its claims with what the API expected.

When an API request fails, teams often need to know whether the wrong token was sent, whether the claims are stale, or whether the verifier is misconfigured.

Open the tool Expected result

How to use it

Step 1

Extract the bearer token cleanly

Remove the header prefix and keep only the token string.

Step 2

Inspect header and payload

Review alg, aud, iss, scopes, and time claims side by side.

Step 3

Compare with the API contract

Check whether the request used the right issuer, audience, or role claims.

Sample input

Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJhcGkifQ.signature

Expected result

You can quickly tell whether the 401 came from the token itself or from separate API-side validation logic.

Common mistakes

Leaving the `Bearer` prefix in the parser input.
Comparing against outdated audience values.
Sharing full tokens in bug reports without redaction.

Related workflows

Check whether a JWT is expired or not yet valid

Guide

Inspect custom JWT claims before changing auth rules

Guide

Related tools