pixop-decode-jwt

Decode a JWT header and payload with jq for human inspection. Does not validate the signature, expiry for authorization, or Marketplace entitlements. For license operations on AWS, prefer pixop-license decode / status; on KVM hosts use pixop-install license status.

Usage

pixop-decode-jwt [JWT]
pixop-decode-jwt -f FILE
pixop-decode-jwt -h|--help

Form	Behavior
`pixop-decode-jwt`	Read `/etc/pixop-live/license.jwt` if present
`pixop-decode-jwt TOKEN`	Decode inline token (single argument)
`pixop-decode-jwt -f FILE`	Read token from file (whitespace stripped)

What changes / what never changes

Changes	Never changes
Nothing	License file, activation state

The raw token is never printed—only decoded JSON sections.

Preconditions

jq installed on the appliance (exit 1 if missing).
Readable JWT file or argument.

Works on AL2023 guest. Not part of the KVM host installer bundle.

Typical workflows

Inspect the appliance license file:

pixop-decode-jwt

Decode a staging file without installing it:

pixop-decode-jwt -f /path/to/license.jwt

Compare with high-level license tool (AWS):

pixop-license decode
pixop-decode-jwt

pixop-license decode is the supported operator path when available; this script is a thin base64url + jq helper for the same on-disk JWT.

Output interpretation

== Header ==
{ ... sorted JSON ... }

== Payload ==
{ ... sorted JSON ... }

exp: <unix>  (<UTC ISO8601>)
nbf: ...
iat: ...

Time fields print only when present in the payload. jq sorts keys (-S) for stable diffs.

Invalid structure exits 2:

Invalid JWT (need header.payload.signature)
Failed to decode JWT (bad base64url?)
No JWT provided…

Decoded content is sensitive: customer IDs, product SKUs, trial dates, and internal claims may appear. Treat like credential material.

Security

Not cryptographic proof of license validity.
Do not paste output into Git, public chat, or unredacted support bundles.
Prefer pixop-license status --json for operational state when License Manager integration exists.
Never log the input token; the script avoids echoing it, but shell history may capture pixop-decode-jwt eyJ… one-liners—use -f with mode 0600 files instead.

Common errors

Message	Cause
`ERROR: jq is required`	Install `jq` or use `pixop-license decode`
`No JWT provided`	No arg and no default file
Decode failures	Truncated token, wrong file, non-JWT text

Version note

Long available on appliance images as a debugging aid. License tooling ships via pixop-license on supported recipes; this script may or may not be on PATH on every SKU—use command -v pixop-decode-jwt.

pixop-license — status, doctor, refresh (AWS)
KVM quickstart — pixop-install license set
Configuration — license file path and permissions