{"version":"2.1.224","anchor":"self-hosted-runner-decode-token-inspects-a-session-token-ver","canonical_anchor":"self-hosted-runner-decode-token-inspects-a-session-token-ver","heading":"self-hosted-runner decode-token inspects a session token, verifying it by default","tier":"use","area":"Self-Hosted Runner","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224\/e\/self-hosted-runner-decode-token-inspects-a-session-token-ver","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224","markdown":"### `self-hosted-runner decode-token` inspects a session token, verifying it by default\n\ndecode-token prints a session token's claims, verifying signature and expiry by default.\n\n**What**\n\nDecodes a session access token and prints its claims, reading it from an argument, from `$CLAUDE_CODE_SESSION_ACCESS_TOKEN`, or from stdin up to 16 KiB. Signature verification against the published key set and the expiry\/not-before check with 60 seconds of clock skew are both on by default.\n\n**Details**\n\n- `--no-verify` skips the signature check, `--no-check-expiry` skips the time check, `--header` prints the token header instead of the claims.\n- `--verify` still parses but does nothing, kept so older wrapper scripts do not break.\n- Only ES256 and RS256 signatures are accepted.\n\n**Usage**\n\n`claude self-hosted-runner decode-token --header` **Evidence** `decode-token: signature verification FAILED`\n\n- Area: Self-Hosted Runner\n- Names: `self-hosted-runner decode-token`, `CLAUDE_CODE_SESSION_ACCESS_TOKEN`, `--header`, `--no-check-expiry`, `--no-verify`\n- Tier: Use it now\n- Useful: 2\/5\n- Signal: 3\/5"}