Complete auth debugging workflow: JWT + JSON + Base64 (step by step)

A repeatable workflow to debug login/401 issues: clean token, inspect claims, convert exp, format errors, isolate root causes.

Updated: 2026-03-22

On this guide

How to use this guide well

These guides are more useful when you read them as operational help, not as filler documentation.

Start from the section that matches the failure

Do not read linearly if you do not need to. Jump to the section that looks closest to the incident, payload, or config you are debugging.

Copy only after you understand the constraint

The useful part is usually in the caveat, not in the snippet itself: timezone, dialect, schema, audience, type inference, or portability.

Then validate with the tool

Once the reasoning is clear, use the related tool to inspect the real value, payload, or expression instead of working from memory.

A quick scan before you dive in.

Sections

Code examples

A short workflow tuned to the type of issue this guide covers.

Inspect the raw token first

Remove the Bearer prefix, inspect exp, nbf, iss, aud, and roles before assuming the backend is wrong.

Check trust boundaries

Separate decode from verify. A readable payload is not proof that the token is valid for your API or environment.

Compare against the live environment

Validate issuer, audience, key rotation, and clock skew against the service that is actually rejecting the request.

For 401/403, answer fast: expired token? wrong audience? missing scopes? wrong key? This is a repeatable 5–10 min routine.

Remove “Bearer ” prefix and ensure header.payload exists.

exp/nbf, iss, aud, scopes/roles, header.alg/kid.

Decode ≠ verify. Compare environments and clocks. Share redacted header/payload and formatted error bodies.

Use the matching tool when you want to validate or reproduce the issue described in this guide.

Validate and format JSON with clear errors and quick copy.

Decode JWT header and payload locally without sending data.

Transform timestamps ↔ dates in seconds or milliseconds.

Move between deep guides and shorter task-focused articles so the site works like a connected knowledge base, not a dead end.

Clear explanation: what decoding tells you, what you cannot know without signature verification, examples, pitfalls, and FAQ.

Practical guide: why JSON breaks, real examples, common mistakes, debugging tips, and FAQ.

Practical checklist: tokens, headers, logs, screen sharing, extensions, and how to redact data in tickets.