---
title: "Verify every token · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/token-checks
updated: 2026-10-20
licence: "All rights reserved"
---

# Verify every token

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)
- Rule: Check the signature, algorithm, expiry and audience of every signed token, such as a JWT. Keep tokens short-lived.
- How: Use a maintained library and pin the algorithms you accept. Check `exp`, `iss` and `aud` on every token. Never let the token's own header pick the algorithm or fetch a key, such as `alg`, `jku` or `x5u`. Use `kid` only to pick from your own list of keys. An HMAC key needs at least 256 random bits. Give access tokens a life of 15 minutes or less, and use a refresh token that the server can revoke.
- Check: Send a token with its signature removed and another with `alg` set to `none`. Send an expired one, one for another audience and one signed with a guessed key such as `secret`. Every request returns 401.

Example:

```js
// Node with jose: algorithm, issuer and audience are fixed by the server
import { jwtVerify } from 'jose';
const { payload } = await jwtVerify(token, publicKey, {
  algorithms: ['ES256'], issuer: 'https://login.example.com', audience: 'https://api.example.com',
});
```

```python
# Python with PyJWT
claims = jwt.decode(token, public_key, algorithms=["ES256"],
                    issuer="https://login.example.com", audience="https://api.example.com")
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/token-checks`.

- Previous: [Accept only the fields you expect](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/mass-assignment)
- Next: [Offer two-factor login](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/two-factor-login)
- [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)