What?
This is an library designed to handle authentication in server-to-server API requests. It accomplishes this using RSA public / private key pairs.
Why?
The standard pattern of using username and password works well for user-to-server requests, but is lacking for server-to-server applications. In these scenarios, since the password doesn’t need to be memorable by a user, we can use something far more secure: asymmetric key cryptography. This has the advantage that a password is never actually sent to the server.
How?
A public / private key pair is generated by the client machine. The server machine is then supplied with the public key, which it can store in any method it likes. When this library is used with Django, it provides a model for storing public keys associated with built-in User objects. When a request is made, the client creates a JWT including several claims and signs it using it’s private key. Upon receipt, the server verifies the claim to using the public key to ensure the issuer is legitimately who they claim to be.
The claim (issued by the client) includes components: the username of the user who is attempting authentication, the current unix timestamp, and a randomly generated nonce. For example:
{
"username": "guido",
"time": 1439216312,
"nonce": "1"
}
The timestamp must be within ±20 seconds of the server time and the nonce must be unique within the given timestamp and user. In other words, if more than one request from a user is made within the same second, the nonce must change. Due to these two factors no token is usable more than once, thereby preventing replay attacks.
To make an authenticated request, the client must generate a JWT following the above format and include it as the HTTP Authorization header in the following format:
Authorization: JWT <my_token>
Important note: the claim is not encrypted, only signed. Additionally, the signature only prevents the claim from being tampered with or re-used. Every other part of the request is still vulnerable to tamper. Therefore, this is not a replacement for using SSL in the transport layer.
Full Documentation: https://asymmetric-jwt-auth.readthedocs.io
1 maintainer
Metadata
1 maintainer
Release files for asymmetric-jwt-auth 1.2.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| asymmetric_jwt_auth-1.2.1.tar.gz | 71.2 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| asymmetric_jwt_auth-1.2.1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 106.4 kB
Release files / asymmetric_jwt_auth-1.2.1.tar.gz
| Download URL | asymmetric_jwt_auth-1.2.1.tar.gz |
|---|---|
| Size | 71.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
174339ba33c52d276cd26e98ee79bcdfc91270b435acae33ba3f5633f5d970e0
|
|
BLAKE2b-256 checksum How to use checksums |
a26f6dd23eb2b5720771c9420ec8e4cdc268d5e7398ff75d2259a2aa4d60e6b7
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.3
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitLab CI/CD, verified by PyPI on Aug 11, 2025.
Transparency logRelease files / asymmetric_jwt_auth-1.2.1-py3-none-any.whl
| Download URL | asymmetric_jwt_auth-1.2.1-py3-none-any.whl |
|---|---|
| Size | 35.1 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
755d2c3fa71ad37d1eed8baf57fd60b6204500b2c796bd02687064814d9765dd
|
|
BLAKE2b-256 checksum How to use checksums |
86ebea4831332271f563e9b28fe02b475e0ae105d7b5822f45322b45175dab51
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.3
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitLab CI/CD, verified by PyPI on Aug 11, 2025.
Transparency log
