# Check JWT security of API endpoints with HTTP: n8n workflow

> Started by a clock, and works across Google Sheets. 22 steps, 1 branch, 1 loop or waits: large, and worth reading before you trust it with anything live.

Source: https://millionrounds.com/workflow/check-jwt-security-of-api-endpoints-with-http (Millionrounds; every figure on the page links to its filing or article)

[Automation library](https://millionrounds.com/workflows) · [Data collection](https://millionrounds.com/workflows?category=Data+collection#library)

# Check JWT security of API endpoints with HTTP

Started by a clock, and works across Google Sheets. 22 steps, 1 branch, 1 loop or waits: large, and worth reading before you trust it with anything live.

Large

[Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fcheck-jwt-security-of-api-endpoints-with-http)

**22 steps** Large: read it before trusting it with anything live

**1** Branch: places the flow splits

**1** Loop or waits

**1** Service it connects to

## The flow

Starts it 2 Logic 14 Service 6

The steps in the order they run, from what starts it.

- 1 **When Triggered Manually** Manual trigger *Starts it*
- 2 **When Daily at 08:00** Schedule trigger *Starts it*
- 3 **Set Sheet Variables** Set *Logic*
- 4 **Read from Sheets** Google Sheets *Service*
- 5 **Filter Active Endpoints** Filter *Logic*
- 6 **Loop Over Endpoint Batches** Split In Batches *Logic*
- 7 **Decode JWT and Build Tokens** Code *Logic*
- 8 **Validate Token via HTTP** Http Request *Service*
- 9 **Extract Valid Token Status** Code *Logic*
- 10 **Check Valid Token Pass** If *Logic*
- 11 **HTTP Request No Auth** Http Request *Service*
- 12 **Tampered Token HTTP Request** Http Request *Service*
- 13 **Algorithm None HTTP Request** Http Request *Service*
- 14 **Merge Valid and No Auth Results** Merge *Logic*
- 15 **Handle Failed Token Validation** Code *Logic*
- 16 **Extract No Auth Status** Code *Logic*
- 17 **Extract Tampered Status** Code *Logic*
- 18 **Extract Alg None Status** Code *Logic*
- 19 **Merge All JWT Results** Merge *Logic*
- 20 **Append to Sheets** Google Sheets *Service*
- 21 **Merge Tampered and Alg Results** Merge *Logic*
- 22 **Analyze JWT Results** Code *Logic*

## How it's built

- **Starts on:** A clock
- **Steps:** 22, with 1 branch, 1 loop or waits
- **Size:** Large: read it before trusting it with anything live
- **Connects to:** Google Sheets
- **Model:** None. This is plumbing, not judgement

## Questions

What does it need to run?

An n8n account, plus your own Google Sheets account. You connect your own accounts after importing it; none are included.

What starts it?

It starts on a clock.

Does it use AI?

No. Every step is fixed logic or a call to a service, so it does the same thing every time.

How long does it take to set up?

Take your time. At 22 steps it is large: read it before trusting it with anything live.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

**Before you run it**

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 22 steps before you point it at anything that matters.

## Run it in n8n

- **Create your n8n account** Free to start. n8n is where the workflow runs. [Create an n8n account ↗](https://millionrounds.com/n8n)
- **Download the workflow** Free with a Millionrounds account. [Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fcheck-jwt-security-of-api-endpoints-with-http)
- **Paste it into n8n** Open a new workflow in n8n and paste. Then connect your own accounts.

Stored with the author's traces removed: canvas notes, instance identifiers, saved credential names and any live document they had left behind.

## Connects to

Each opens the other workflows that use it.

[Google Sheets](https://millionrounds.com/workflows?service=Google+Sheets#library)

## Workflows like it

Also data collection, with the same services where possible, closest in size first.

- [**Employee attendance tracker with Telegram Bot** 22 steps · Google Sheets, Telegram](https://millionrounds.com/workflow/employee-attendance-tracker-with-telegram-bot)
- [**Manage portfolio assets with Google Sheets** 22 steps · Google Sheets](https://millionrounds.com/workflow/manage-portfolio-assets-with-google-sheets)
- [**Push Dialpad call information to Syncro with Google Sheets** 22 steps · Google Sheets](https://millionrounds.com/workflow/push-dialpad-call-information-to-syncro-with-google-sheets)
- [**Repurpose YouTube Shorts to TikTok and Instagram with Blotato** 22 steps · Google Sheets](https://millionrounds.com/workflow/repurpose-youtube-shorts-to-tiktok-and-instagram-with-blotat)
- [**Sync WhatsApp conversations to GoHighLevel notes with Wati** 22 steps · Google Sheets, Slack](https://millionrounds.com/workflow/sync-whatsapp-conversations-to-gohighlevel-notes-with-wati)
- [**Track and assess wildlife sightings with GBIF and Gemini** 22 steps · Email, Google Sheets](https://millionrounds.com/workflow/track-and-assess-wildlife-sightings-with-gbif-and-gemini)