# JSON Web Token (JWT) integrations

> Create signed tokens for API calls, and check incoming tokens before a workflow trusts them.

**Canonical page:** https://tray.ai/connectors/json-web-token-jwt-integrations/
**Categories:** Developer tools
**Connects through:** Connector

## Overview

Many APIs ask for a signed JSON Web Token instead of a static key, and many services send one to prove where a request came from. The JWT helper has two operations, Sign and Verify. The signing key lives in a Tray authentication, so it stays out of the execution logs.

## Use cases

### Call APIs that expect a JWT

Sign a token with the claims an API asks for, such as issuer, audience and expiry, then send it with the HTTP Client as a bearer token.

- Claims set per request
- Short-lived tokens
- Pairs with the HTTP Client

### Check incoming requests

Verify a token sent to a webhook, checking audience, issuer and expiry, and branch on the result: carry on if it's valid, reply with an error if it isn't.

- Reject forged requests
- Expiry checked for you
- Clear valid and invalid paths

## Challenges Tray.ai solves

### Keeping signing keys secret

A key pasted into a workflow step can end up in execution logs.

**How Tray.ai helps:** Keep the key in the JWT authentication, where it is stored securely. Tray warns that overriding it in the step leaves the value visible in the logs.

### Handling bad tokens cleanly

An expired or tampered token should stop the workflow without breaking it.

**How Tray.ai helps:** Verify supports manual error handling, so an invalid token takes its own path, for example a reply that rejects the request.

## Learn more

- Intelligent Integration: https://tray.ai/platform/intelligent-ipaas/
- Merlin Agent Builder: https://tray.ai/platform/merlin-agent-builder/
- Agent Gateway for MCP: https://tray.ai/platform/agent-gateway/
- Book a demo: https://tray.ai/contact/