Script on API Clients

Introduction

My day-to-day work involves calling identity providers for tokens and inspecting them. This means handling a lot of JWTs and frequently visiting jwt.io to debug claims. The amount of time I spend going to jwt.io caused a lot of friction, forcing me to find a better way.

Out of this frustration, I realized I could use my Postman or Bruno post-test scripts to automatically decode the JWT and log the content directly to the console. The moment I started using this, it made my life significantly better.

Here is the script if anyone would like to use it. Just paste this into the post-response script section within Postman or Bruno:

// 1. Parse the JSON response body
const resBody = res.getBody();

if (resBody && resBody.access_token) {
  const token = resBody.access_token;
  
  // 2. Split the JWT into parts (Header, Payload, Signature)
  const parts = token.split('.');
  
  if (parts.length === 3) {
    try {
      // 3. Decode the Base64Url-encoded payload
      const payloadBase64Url = parts[1];
      // Convert Base64Url to standard Base64 by replacing characters
      const payloadBase64 = payloadBase64Url.replace(/-/g, '+').replace(/_/g, '/');
      
      // Decode and parse JSON
      const decodedPayload = JSON.parse(atob(payloadBase64));
      
      // 4. Print nicely formatted output to the Bruno console
      console.log('--- Decoded JWT Payload ---');
      console.log(JSON.stringify(decodedPayload, null, 2));
      console.log('---------------------------');
      
      // Optional: Save token or claims to environment variables if needed later
//       bru.setEnvVar('current_access_token', token);
      
    } catch (e) {
      console.error('Failed to decode JWT payload:', e.message);
    }
  } else {
    console.error('Invalid JWT format received.');
  }
} else {
  console.log('No access_token found in response body.');
}

alt text