{"id":46662,"library":"truelayer-signing","title":"TrueLayer Signing","description":"Produce & verify TrueLayer API requests signatures. Current version 0.3.8, requires Python >=3.8.1. Released regularly.","status":"active","version":"0.3.8","language":"python","source_language":"en","source_url":"https://github.com/TrueLayer/truelayer-signing","tags":["truelayer","signing","jwk","api","authentication"],"install":[{"cmd":"pip install truelayer-signing","lang":"bash","label":"Install from PyPI"}],"dependencies":[],"imports":[{"wrong":"from truelayer_signing import sign_with_jwk","symbol":"sign_with_pem","correct":"from truelayer_signing import sign_with_pem"},{"symbol":"TlSigner","correct":"from truelayer_signing import TlSigner"},{"symbol":"TlVerifier","correct":"from truelayer_signing import TlVerifier"}],"quickstart":{"code":"import os\nfrom truelayer_signing import sign_with_jwk, verify_signature\n\n# Sign a request\nkid = os.environ.get('TL_KID', '')\njwk = os.environ.get('TL_JWK', '')\nmethod = 'POST'\npath = '/api/v1/payments'\nheaders = {'Idempotency-Key': 'unique-key'}\nbody = b'{\"amount\": 100, \"currency\": \"GBP\"}'\n\nsigned_headers = sign_with_jwk(kid, jwk, method, path, headers, body)\nprint(signed_headers)\n\n# Verify a request\nfrom_headers = {'X-Tl-Signature': '...'}\nresult = verify_signature(jwk, method, path, from_headers, body)\nprint('Verified:', result)","lang":"python","description":"Sign and verify HTTP requests using JWK."},"warnings":[{"fix":"Encode string bodies: body.encode('utf-8')","message":"The body parameter must be bytes, not str. Passing a string will cause a TypeError.","severity":"gotcha","affected_versions":"all"},{"fix":"Ensure header names are lowercase, e.g., 'idempotency-key' not 'Idempotency-Key'.","message":"The headers parameter should be a dict with lowercase header names. Mismatched keys may cause verification failure.","severity":"gotcha","affected_versions":"all"},{"fix":"Use sign_with_jwk and verify_signature instead.","message":"In version 0.2.0, the function sign changed to sign_with_jwk and verify to verify_signature.","severity":"breaking","affected_versions":"<0.2.0"},{"fix":"Wrap in try/except ValueError to handle missing signatures gracefully.","message":"verify_signature raises ValueError if the signature header is missing or malformed, not returning False.","severity":"gotcha","affected_versions":"all"}],"env_vars":null,"search_vec":"'0.3.8':11 '3.8.1':14 'api':6,20 'authent':21 'current':9 'jwk':19 'produc':3 'python':13 'regular':16 'releas':15 'request':7 'requir':12 'sign':2,18 'signatur':8 'truelay':1,5,17 'verifi':4 'version':10","created_at":"2026-06-07T13:01:01.485904+00:00","updated_at":"2026-06-07T13:01:01.485904+00:00","problems":null,"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"https://github.com/TrueLayer/truelayer-signing/tree/main/python","github":"https://github.com/TrueLayer/truelayer-signing","docs":null,"changelog":null,"pypi":null,"npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-07-03","last_verified":"2026-07-03","next_check":"2026-08-02","install_tag":null}}