token
Decode a PASETO v4.public token and print its header, footer, and claims. Useful for debugging.
base-idp token decodes a PASETO token without verifying the signature, so
you can see exactly what is inside. This is a debugging tool. It is for the
moment when a token is being rejected and you want to see the audience, the
expiry, or the subject without writing throwaway code.
npx base-idp token v4.public.eyJpc3MiOi...{
"header": {
"version": "v4",
"purpose": "public"
},
"footer": {
"kid": "k_01HRZ...",
"alg": "v4.public",
"typ": "paseto"
},
"claims": {
"iss": "https://authlayer.squareexp.com",
"sub": "usr_01HRZ...",
"aud": "sq_live_yourapp",
"exp": "2026-06-29T15:22:08.000Z",
"nbf": "2026-06-29T14:21:38.000Z",
"iat": "2026-06-29T14:22:08.000Z",
"jti": "tok_01HRZ...",
"gid": "gid_01HRZ...",
"email": "emai@domain.com",
"name": "First Name",
"token_use": "access",
"sid": "ses_01HRZ...",
"scopes": ["openid", "profile"],
"role": "operator"
}
}If the token is expired, the CLI prints a warning underneath.
⚠ Token is EXPIREDThis command does not verify
token only decodes — it does not verify the signature. A maliciously crafted
token will decode just fine and print whatever claims it claims to have. Use
the SDK's verifier for any real authentication decision. This command is for
your eyes, not your auth path.
What each field tells you
Header
The version and purpose. For Base IdP tokens this is always v4 / public.
If it is anything else you have the wrong kind of token.
Footer
kid— the key id that signed the token. The SDK uses this to look up the public key. If a verifier complains about an unknownkid, this is the one it could not find.alg— alwaysv4.public.typ— alwayspaseto.
Claims
The standard PASETO / OIDC claims. The ones you reach for most often:
iss— issuer. Should behttps://authlayer.squareexp.comin production.sub— subject. The user id within the issuer.aud— audience. Tells you which app this token was minted for.exp— expiration. Ifexpis in the past, every verifier will reject.iat— issued-at.jti— token id. Used for revocation.gid— global user id. Stable across products.email,name— user identity.token_use—accessfor access tokens,refreshfor refresh tokens.scopes— what was granted.
Common debugging moments
"My backend says signature failed"
Decode the token, look at aud. If it does not match the app your backend
is verifying for, your frontend is talking to the wrong client id.
If aud looks right, check kid. Has the key rotated? Restart your backend
so the SDK re-fetches the key set.
"My backend says token expired"
Decode the token, look at exp. If it is in the past, your frontend is
sending a stale token — refresh failed, or you cached the access token
beyond its lifetime.
"I am getting invalid_grant on exchange"
That is a code error, not a token error. Run base-idp test instead — you
do not have a token yet at that point in the flow.