Registry / security / truelayer-signing

truelayer-signing

JSON →

library0.3.8pypypi✓ verified 85d ago

Produce & verify TrueLayer API requests signatures. Current version 0.3.8, requires Python >=3.8.1. Released regularly.

security

pip install truelayer-signing

github ↗homepage ↗

INSTALL

IMPORT

SIG · TRUELAYER-SIGNING

truelayer-signing

securitypythonv0.3.8

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

sign_with_pem

✓ from truelayer_signing import sign_with_pem

✗ from truelayer_signing import sign_with_jwk

TlSigner

✓ from truelayer_signing import TlSigner

TlVerifier

✓ from truelayer_signing import TlVerifier

Sign and verify HTTP requests using JWK.

import os from truelayer_signing import sign_with_jwk, verify_signature # Sign a request kid = os.environ.get('TL_KID', '') jwk = os.environ.get('TL_JWK', '') method = 'POST' path = '/api/v1/payments' headers = {'Idempotency-Key': 'unique-key'} body = b'{"amount": 100, "currency": "GBP"}' signed_headers = sign_with_jwk(kid, jwk, method, path, headers, body) print(signed_headers) # Verify a request from_headers = {'X-Tl-Signature': '...'} result = verify_signature(jwk, method, path, from_headers, body) print('Verified:', result)

Debug

Known issues

gotchaThe body parameter must be bytes, not str. Passing a string will cause a TypeError.

fix

Encode string bodies: body.encode('utf-8')

affects: all

gotchaThe headers parameter should be a dict with lowercase header names. Mismatched keys may cause verification failure.

fix

Ensure header names are lowercase, e.g., 'idempotency-key' not 'Idempotency-Key'.

affects: all

breakingIn version 0.2.0, the function sign changed to sign_with_jwk and verify to verify_signature.

fix

Use sign_with_jwk and verify_signature instead.

affects: <0.2.0

gotchaverify_signature raises ValueError if the signature header is missing or malformed, not returning False.

fix

Wrap in try/except ValueError to handle missing signatures gracefully.

affects: all

Upgrade

Version history

0.3.8latest on PyPI · released Jul 18, 2025

Audit

Dependencies

No dependency data recorded yet.

Agent activity

24 hits · last 30 days

node

Resources

githubhttps://github.com/TrueLayer/truelayer-signing ↗

homepagehttps://github.com/TrueLayer/truelayer-signing/tree/main/python ↗