⚡ Built for integration testing

JWTs without the identity plumbing.

Mint correctly signed test tokens in seconds. Choose a preset, edit any claim, and use the same issuer from your browser, scripts, APIs, or an MCP-enabled agent.

Issue a token →View documentation

RS256 + public JWKSOAuth metadataMCP tools

POST /api/token

{
  "preset": "delegated-agent",
  "claims": {
    "sub": "alice",
    "aud": "https://bank.example/mcp",
    "scope": "portfolio.read",
    "act": { "sub": "advisor-agent" }
  }
}

→ 200
{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600
}

One issuer. Three interfaces.

Spend time testing your product, not configuring an IdP.

JWT Lab intentionally stops before becoming a full authorization server. Its job is to give you the token shape you need, signed by a stable issuer.

✦

Visual token lab

Start from practical presets for users, workloads, MCP clients, delegated agents and negative tests. Then edit every claim as raw JSON.

/app

⌘

Simple issuance API

Automate tests with one POST. No clients, users, grants, redirect URIs or consent screens required.

POST /api/token

◈

MCP-native

Let an agent mint the exact token it needs while testing an API, gateway or MCP server. The same presets are exposed as MCP tools.

/mcp

🔑

Stable validation

Every token is RS256 signed and references a stable key id. Consumers validate with the public JWKS endpoint.

/.well-known/jwks.json

◎

OAuth-shaped metadata

Publish issuer and JWKS discovery information without pretending JWT Lab implements real login or grant flows.

/.well-known/oauth-authorization-server

↳

Delegation scenarios

Create token-exchange-style output using act, nested actors, reduced scopes and downstream audiences — without implementing token exchange.

preset: delegated-agent

Need a token with weird claims right now?

Open the lab, edit the payload, sign it, copy it. Done.

Open JWT Lab →