Apigee Interview Question: What Is the DecodeJWT Policy?

Preparing for an Apigee Developer interview? The DecodeJWT policy is used to decode a JSON Web Token (JWT) and extract its header and payload claims into Apigee flow variables.

It is useful when you need to inspect information such as a user's identity, token issuer, audience, or scopes during API processing.

1. What Is the DecodeJWT Policy?

A JWT typically contains three parts:

Header.Payload.Signature

The DecodeJWT policy decodes the JWT header and payload without verifying the signature.

For example, a JWT payload might contain:

{
  "sub": "user123",
  "role": "admin",
  "iss": "payment-auth-service"
}

After decoding, Apigee can access these claims through flow variables.

Important: Decoding a JWT does not prove that it is authentic or trustworthy. Use the VerifyJWT policy to validate the signature and applicable token claims before relying on the token for authentication or authorization.

2. DecodeJWT Policy XML Example

<DecodeJWT name="Decode-Access-Token">
    <DisplayName>Decode Access Token</DisplayName>
    <Source>request.header.authorization</Source>
</DecodeJWT>

This example reads the JWT from the Authorization header.

The request must include the Bearer prefix, for example:

Authorization: Bearer eyJhbGciOi...

Apigee handles the Authorization header's Bearer format when using it as the token source.

3. How Does It Work?

1. The client sends a JWT in the Authorization header.
2. Apigee executes the DecodeJWT policy.
3. The policy decodes the JWT header and payload.
4. The extracted claims become available as flow variables for subsequent proxy logic.

For example, if the policy name is Decode-Access-Token, the subject claim can be accessed using:

jwt.Decode-Access-Token.decoded.claim.sub

The issuer claim can be accessed using:

jwt.Decode-Access-Token.decoded.claim.iss

4. DecodeJWT vs. VerifyJWT

Feature	DecodeJWT	VerifyJWT
Purpose	Decodes JWT claims	Validates JWT authenticity
Signature verification	No	Yes, for signed JWTs
Extracts claims	Yes	Yes
Validates expiry	Does not establish token validity	Checks applicable time claims
Typical use	Inspect token contents	Authenticate and validate tokens

5. When Should You Use DecodeJWT?

Common use cases include:

• Inspecting JWT claims during API processing.
• Reading token metadata for debugging.
• Examining claims before signature verification, when necessary.
• Supporting troubleshooting alongside VerifyJWT.

Security best practice: Never authorize a payment or grant access to a protected resource solely because DecodeJWT successfully decoded the token.

6. Frequently Asked Interview Questions

Q1. Does DecodeJWT verify the JWT signature?

No. It only decodes the token's header and payload.

Q2. Can DecodeJWT decode an expired JWT?

Decoding does not establish whether a token is expired or valid. Use VerifyJWT to validate applicable time claims and signature requirements.

Q3. Which flow variable contains the decoded subject?

For a policy named Decode-Access-Token, use:

jwt.Decode-Access-Token.decoded.claim.sub

Q4. What happens if the JWT is malformed?

The policy raises an error if the token cannot be decoded. You can handle policy errors using Apigee fault handling.

Q5. Can DecodeJWT be used with VerifyJWT?

Yes. However, VerifyJWT itself extracts claims, so DecodeJWT is only needed when you specifically require decoding without verification.

Conclusion

The DecodeJWT policy decodes JWT headers and payloads and exposes their claims through Apigee flow variables.

Interview takeaway: Remember the key difference: DecodeJWT reads the token; VerifyJWT validates it.

Official documentation: Apigee DecodeJWT policy