Auths Python SDK

Decentralized identity for developers and AI agents. Sign, verify, and manage cryptographic identities with Git-native storage.

Install

pip install auths

Quick start

from auths import Auths

auths = Auths()

# Verify an attestation
result = auths.verify(attestation_json=data, issuer_key=public_key_hex)
print(result.valid)  # True

# Sign bytes
signature = auths.sign(b"hello world", private_key=secret_key_hex)

Identity management

from auths import Auths

auths = Auths(repo_path="~/.auths")

# Create a cryptographic identity
identity = auths.identities.create(label="laptop")
print(identity.did)  # did:keri:EBfd...

# Provision an agent (for CI, MCP servers, etc.)
agent = auths.identities.provision_agent(
    identity.did,
    name="deploy-bot",
    capabilities=["sign"],
)

# Sign using the keychain-stored identity key
sig = auths.sign_as(b"hello world", identity=identity.did)

# Link and manage devices
device = auths.devices.link(identity_did=identity.did, capabilities=["sign"])
auths.devices.revoke(device.did, identity_did=identity.did, note="replaced")

Keyless service-to-service verify

Verify an agent's credential presentation offline against a pinned root — one call, a typed Status enum, no exception for a denial:

from auths import verify_presentation, PresentationStatus

report = verify_presentation(bundle_json)  # the Auths-Presentation request bundle
if report.status is not PresentationStatus.VALID:
    raise PermissionError(f"denied: {report.status}")  # WRONG_AUDIENCE, EXPIRED, …

print(report.subject, report.caps)  # granted holder + capabilities

verify_credential(bundle_json) returns a CredentialReport the same way — e.g. report.status is CredentialStatus.CREDENTIAL_REVOKED carries report.revoked_at. Malformed input returns a typed MALFORMED_REQUEST status; it never raises.

Git commit verification

from auths.git import verify_commit_range

result = verify_commit_range("HEAD~5..HEAD")
for commit in result.commits:
    print(f"{commit.commit_sha}: {'valid' if commit.is_valid else commit.error}")

Time-pinned verification

# Verify an attestation's authenticity at a historical point in time
result = auths.verify(attestation_json=data, issuer_key=key, at="2024-06-15T00:00:00Z")

Capability/role authority is no longer checked at verification time. A capability grant comes from a holder-verified ACDC credential, not the attestation.

Agent auth for MCP / AI frameworks

from auths.agent import AgentAuth

auth = AgentAuth(
    bridge_url="https://bridge.example.com",
    attestation_chain_path=".auths/agent-chain.json",
)
token = auth.get_token(capabilities=["read", "write"])

Error handling

from auths import Auths, VerificationError, NetworkError

auths = Auths()
try:
    result = auths.verify(attestation_json=data, issuer_key=key)
except VerificationError as e:
    print(e.code)     # "expired_attestation"
    print(e.message)  # "Attestation expired at 2024-01-15T..."
except NetworkError as e:
    if e.should_retry:
        pass  # safe to retry

All errors inherit from AuthsError and carry .code, .message, and .context.

Configuration

# Auto-discover (uses ~/.auths)
auths = Auths()

# Explicit repo path
auths = Auths(repo_path="/path/to/identity-repo")

# With passphrase (or set AUTHS_PASSPHRASE env var)
auths = Auths(passphrase="my-secret")

# Headless / CI mode
# Set AUTHS_KEYCHAIN_BACKEND=file for environments without a system keychain

API reference

Type stubs are bundled (py.typed + __init__.pyi). Your editor will show full signatures, docstrings, and return types for all methods.

License

Apache-2.0

Project links

Data verified by PyPI on Jul 19, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.1.16)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for bordumb from gravatar.com bordumb

GitHub Statistics

Data verified by PyPI on Jul 19, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

Apache Software License (Apache-2.0)

Requires

Python >=3.8

Provides Extra

jwt

Tags

identity cryptography did signing verification git keri

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

auths-0.1.11.tar.gz (1.8 MB view details)

Uploaded Source

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

auths-0.1.11-cp38-abi3-win_amd64.whl (8.0 MB view details)

Uploaded CPython 3.8+Windows x86-64

auths-0.1.11-cp38-abi3-musllinux_1_2_x86_64.whl (8.2 MB view details)

Uploaded CPython 3.8+musllinux: musl 1.2+ x86-64

auths-0.1.11-cp38-abi3-musllinux_1_2_aarch64.whl (7.6 MB view details)

Uploaded CPython 3.8+musllinux: musl 1.2+ ARM64

auths-0.1.11-cp38-abi3-manylinux_2_28_x86_64.whl (8.2 MB view details)

Uploaded CPython 3.8+manylinux: glibc 2.28+ x86-64

auths-0.1.11-cp38-abi3-manylinux_2_28_aarch64.whl (7.6 MB view details)

Uploaded CPython 3.8+manylinux: glibc 2.28+ ARM64

auths-0.1.11-cp38-abi3-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl (14.7 MB view details)

Uploaded CPython 3.8+macOS 10.12+ universal2 (ARM64, x86-64)macOS 10.12+ x86-64macOS 11.0+ ARM64

File details

Details for the file auths-0.1.11.tar.gz.

File metadata

  • Download URL: auths-0.1.11.tar.gz
  • Upload date:
  • Size: 1.8 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for auths-0.1.11.tar.gz
Algorithm Hash digest
SHA256 4e96bdc3940559660b72f86a11f4a22633ec5e2468550a46b892115c7868c2fe
MD5 40d462c67fddee7a8e865f88978328b9
BLAKE2b-256 79263b1a344d1d32eb01acdfc56fa4463dc1e551278c519cdf6aabcd5a16c0a6

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.11.tar.gz:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file auths-0.1.11-cp38-abi3-win_amd64.whl.

File metadata

  • Download URL: auths-0.1.11-cp38-abi3-win_amd64.whl
  • Upload date:
  • Size: 8.0 MB
  • Tags: CPython 3.8+, Windows x86-64
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for auths-0.1.11-cp38-abi3-win_amd64.whl
Algorithm Hash digest
SHA256 0039ca8c2527eba33d0e03cd2df28f223c65ac4a1ad1ff4fc9bdce7532d5016a
MD5 da947b9e3d1fa4e74c4d6838c2698dfd
BLAKE2b-256 a2c566d5acafd0ad1a57132877a87865468fa45c9dd50c60cdc0d0c5e11fe861

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.11-cp38-abi3-win_amd64.whl:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file auths-0.1.11-cp38-abi3-musllinux_1_2_x86_64.whl.

File metadata

File hashes

Hashes for auths-0.1.11-cp38-abi3-musllinux_1_2_x86_64.whl
Algorithm Hash digest
SHA256 3e63fcc2840753452cad8fd8396cafcc79d5461fbf0543835d1982e7f348ec2c
MD5 6cc65e8c3ae689e0e2fb2684300708fc
BLAKE2b-256 66e23e10950d27d0a001d321e0ca61e0006496e1474cfd8d0ebf17cc7dca6635

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.11-cp38-abi3-musllinux_1_2_x86_64.whl:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file auths-0.1.11-cp38-abi3-musllinux_1_2_aarch64.whl.

File metadata

File hashes

Hashes for auths-0.1.11-cp38-abi3-musllinux_1_2_aarch64.whl
Algorithm Hash digest
SHA256 a99f0b3dd7172fd3a8758542ef89a89e08d6972eab58b5fd16aa8c081f03414c
MD5 e91099f5a55eb527ccca181f90b83395
BLAKE2b-256 35dd3cc1335d86fd4e20d1b6c75082f263730e132a2276bed0a11d2144a67d84

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.11-cp38-abi3-musllinux_1_2_aarch64.whl:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file auths-0.1.11-cp38-abi3-manylinux_2_28_x86_64.whl.

File metadata

File hashes

Hashes for auths-0.1.11-cp38-abi3-manylinux_2_28_x86_64.whl
Algorithm Hash digest
SHA256 433f096c98004aba9f7a2ad9ef4679e444af9e50b1d9de9ba9357afcb212e0d9
MD5 f756efff7e11e68309b86764960c5cd3
BLAKE2b-256 ca34a879bf29d61b79e252235c1d0147c02b4fc071719010f309e4b07fc07e08

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.11-cp38-abi3-manylinux_2_28_x86_64.whl:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file auths-0.1.11-cp38-abi3-manylinux_2_28_aarch64.whl.

File metadata

File hashes

Hashes for auths-0.1.11-cp38-abi3-manylinux_2_28_aarch64.whl
Algorithm Hash digest
SHA256 46411a2eeee4718363845637c14e3c87b77a7c913a66aca6160c73b5e702620d
MD5 b0b7bff2f066cda4892fdf212626296a
BLAKE2b-256 5e656e0b0a50ada111f3c0a7ae32c294c3ebd2cbad3bd682a998212b05fc8e9d

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.11-cp38-abi3-manylinux_2_28_aarch64.whl:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file auths-0.1.11-cp38-abi3-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl.

File metadata

File hashes

Hashes for auths-0.1.11-cp38-abi3-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl
Algorithm Hash digest
SHA256 c6988c850f1c37473624b6e971c403efc61484c5d630b7e9b86f17aedb72928e
MD5 478a7e12e817ca02bc17a73733343843
BLAKE2b-256 340313e8e5b6479c19d5b4f9850657c64970ae7df31425fe03a1aeced76784e1

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.11-cp38-abi3-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.1.16

7 files

0.1.13

7 files

0.1.12

7 files

This release

0.1.11 This release

7 files

0.1.10

7 files

0.1.9

7 files

0.1.8

7 files

0.1.7

7 files

0.1.6

7 files

0.1.5

7 files

0.1.3

7 files

0.1.2

7 files

0.1.1

7 files

0.1.0

5 files

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page