Auths Python SDK

Decentralized identity for developers and AI agents. Sign, verify, and manage cryptographic identities with Git-native storage.

Install

pip install auths

Quick start

from auths import Auths

auths = Auths()

# Verify an attestation
result = auths.verify(attestation_json=data, issuer_key=public_key_hex)
print(result.valid)  # True

# Sign bytes
signature = auths.sign(b"hello world", private_key=secret_key_hex)

Identity management

from auths import Auths

auths = Auths(repo_path="~/.auths")

# Create a cryptographic identity
identity = auths.identities.create(label="laptop")
print(identity.did)  # did:keri:EBfd...

# Provision an agent (for CI, MCP servers, etc.)
agent = auths.identities.provision_agent(
    identity.did,
    name="deploy-bot",
    capabilities=["sign"],
)

# Sign using the keychain-stored identity key
sig = auths.sign_as(b"hello world", identity=identity.did)

# Link and manage devices
device = auths.devices.link(identity_did=identity.did, capabilities=["sign"])
auths.devices.revoke(device.did, identity_did=identity.did, note="replaced")

Keyless service-to-service verify

Verify an agent's credential presentation offline against a pinned root — one call, a typed Status enum, no exception for a denial:

from auths import verify_presentation, PresentationStatus

report = verify_presentation(bundle_json)  # the Auths-Presentation request bundle
if report.status is not PresentationStatus.VALID:
    raise PermissionError(f"denied: {report.status}")  # WRONG_AUDIENCE, EXPIRED, …

print(report.subject, report.caps)  # granted holder + capabilities

verify_credential(bundle_json) returns a CredentialReport the same way — e.g. report.status is CredentialStatus.CREDENTIAL_REVOKED carries report.revoked_at. Malformed input returns a typed MALFORMED_REQUEST status; it never raises.

Git commit verification

from auths.git import verify_commit_range

result = verify_commit_range("HEAD~5..HEAD")
for commit in result.commits:
    print(f"{commit.commit_sha}: {'valid' if commit.is_valid else commit.error}")

Time-pinned verification

# Verify an attestation's authenticity at a historical point in time
result = auths.verify(attestation_json=data, issuer_key=key, at="2024-06-15T00:00:00Z")

Capability/role authority is no longer checked at verification time. A capability grant comes from a holder-verified ACDC credential, not the attestation.

Agent auth for MCP / AI frameworks

from auths.agent import AgentAuth

auth = AgentAuth(
    bridge_url="https://bridge.example.com",
    attestation_chain_path=".auths/agent-chain.json",
)
token = auth.get_token(capabilities=["read", "write"])

Error handling

from auths import Auths, VerificationError, NetworkError

auths = Auths()
try:
    result = auths.verify(attestation_json=data, issuer_key=key)
except VerificationError as e:
    print(e.code)     # "expired_attestation"
    print(e.message)  # "Attestation expired at 2024-01-15T..."
except NetworkError as e:
    if e.should_retry:
        pass  # safe to retry

All errors inherit from AuthsError and carry .code, .message, and .context.

Configuration

# Auto-discover (uses ~/.auths)
auths = Auths()

# Explicit repo path
auths = Auths(repo_path="/path/to/identity-repo")

# With passphrase (or set AUTHS_PASSPHRASE env var)
auths = Auths(passphrase="my-secret")

# Headless / CI mode
# Set AUTHS_KEYCHAIN_BACKEND=file for environments without a system keychain

API reference

Type stubs are bundled (py.typed + __init__.pyi). Your editor will show full signatures, docstrings, and return types for all methods.

License

Apache-2.0

Project links

Data verified by PyPI on Jul 19, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.1.16)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for bordumb from gravatar.com bordumb

GitHub Statistics

Data verified by PyPI on Jul 19, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

Apache Software License (Apache-2.0)

Requires

Python >=3.8

Provides Extra

jwt

Tags

identity cryptography did signing verification git keri

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

auths-0.1.12.tar.gz (1.8 MB view details)

Uploaded Source

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

auths-0.1.12-cp38-abi3-win_amd64.whl (8.0 MB view details)

Uploaded CPython 3.8+Windows x86-64

auths-0.1.12-cp38-abi3-musllinux_1_2_x86_64.whl (8.2 MB view details)

Uploaded CPython 3.8+musllinux: musl 1.2+ x86-64

auths-0.1.12-cp38-abi3-musllinux_1_2_aarch64.whl (7.6 MB view details)

Uploaded CPython 3.8+musllinux: musl 1.2+ ARM64

auths-0.1.12-cp38-abi3-manylinux_2_28_x86_64.whl (8.2 MB view details)

Uploaded CPython 3.8+manylinux: glibc 2.28+ x86-64

auths-0.1.12-cp38-abi3-manylinux_2_28_aarch64.whl (7.6 MB view details)

Uploaded CPython 3.8+manylinux: glibc 2.28+ ARM64

auths-0.1.12-cp38-abi3-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl (14.7 MB view details)

Uploaded CPython 3.8+macOS 10.12+ universal2 (ARM64, x86-64)macOS 10.12+ x86-64macOS 11.0+ ARM64

File details

Details for the file auths-0.1.12.tar.gz.

File metadata

  • Download URL: auths-0.1.12.tar.gz
  • Upload date:
  • Size: 1.8 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for auths-0.1.12.tar.gz
Algorithm Hash digest
SHA256 7f4d2c9a80cde4d4fc726136a3a7a9c8b6dab4fac77008e61c37675e42150629
MD5 8866c914b21500e829afa3af824f6078
BLAKE2b-256 998058b7a0874661806093684faff39d8df7b89598255fd00d504cbd88d915ab

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.12.tar.gz:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file auths-0.1.12-cp38-abi3-win_amd64.whl.

File metadata

  • Download URL: auths-0.1.12-cp38-abi3-win_amd64.whl
  • Upload date:
  • Size: 8.0 MB
  • Tags: CPython 3.8+, Windows x86-64
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for auths-0.1.12-cp38-abi3-win_amd64.whl
Algorithm Hash digest
SHA256 b4bc4280cec298c21c1832dbf12d36223f7e7c137138fea5e211ed054eda57ab
MD5 6b213b74db24fc54a302e3b531a55a95
BLAKE2b-256 d7c1fb3f8ccc4bb2787c74963b897ff2ce04e39be5a792243cadc192bdaf5cba

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.12-cp38-abi3-win_amd64.whl:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file auths-0.1.12-cp38-abi3-musllinux_1_2_x86_64.whl.

File metadata

File hashes

Hashes for auths-0.1.12-cp38-abi3-musllinux_1_2_x86_64.whl
Algorithm Hash digest
SHA256 32634f5a51891505309e1b496aa5bfc8ecfe993d4202f42267795af0f6e82ae7
MD5 0761136a7ec6a2cabd331bcbb135b34b
BLAKE2b-256 17771e7fc45531a1104f52e53b90695816108353fdbc744b0556114a6058ef2a

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.12-cp38-abi3-musllinux_1_2_x86_64.whl:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file auths-0.1.12-cp38-abi3-musllinux_1_2_aarch64.whl.

File metadata

File hashes

Hashes for auths-0.1.12-cp38-abi3-musllinux_1_2_aarch64.whl
Algorithm Hash digest
SHA256 7239498e364fa0e1583dfba18354b9f09ed2cd07246c15ffa0737d93d3ffbf28
MD5 bd616d1ac5273c3c723734cff4635b1b
BLAKE2b-256 9aff250bdaca23ffdf6c9e8ed617ba503a036aed1451402ed4ca94c80dd37105

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.12-cp38-abi3-musllinux_1_2_aarch64.whl:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file auths-0.1.12-cp38-abi3-manylinux_2_28_x86_64.whl.

File metadata

File hashes

Hashes for auths-0.1.12-cp38-abi3-manylinux_2_28_x86_64.whl
Algorithm Hash digest
SHA256 e0613c5e4632fc74fd6c88d8435b86b9abc2a2fb1b26c04d8030f9e058a1e6df
MD5 b408a5efe23cc455e0e42563d1873156
BLAKE2b-256 8c0cc7eb2fba7dee260ee16446cee28b47353dc1d23d9239fc9a7fb0096253ce

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.12-cp38-abi3-manylinux_2_28_x86_64.whl:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file auths-0.1.12-cp38-abi3-manylinux_2_28_aarch64.whl.

File metadata

File hashes

Hashes for auths-0.1.12-cp38-abi3-manylinux_2_28_aarch64.whl
Algorithm Hash digest
SHA256 73ee1d537a09e3ea38886913552b84d125ade3f8493add71b2f350b3ee14b56e
MD5 ae6504449d92b378d68247b7a17bc084
BLAKE2b-256 38e1585ed5eacf78c9d1ffb756861468deec7c6d535f5486039b07b3109f34a8

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.12-cp38-abi3-manylinux_2_28_aarch64.whl:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file auths-0.1.12-cp38-abi3-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl.

File metadata

File hashes

Hashes for auths-0.1.12-cp38-abi3-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl
Algorithm Hash digest
SHA256 db2668232b2176d855f790b4c8d16cc66b2fe6ac38357603f3664de466e894ba
MD5 afa4c95db9686bd4185194d123880475
BLAKE2b-256 fddfb00a0cce6d935e2cd3603ebaa93ce0f6346a524fd5136b80ab8a778afb83

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.12-cp38-abi3-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.1.16

7 files

0.1.13

7 files

This release

0.1.12 This release

7 files

0.1.11

7 files

0.1.10

7 files

0.1.9

7 files

0.1.8

7 files

0.1.7

7 files

0.1.6

7 files

0.1.5

7 files

0.1.3

7 files

0.1.2

7 files

0.1.1

7 files

0.1.0

5 files

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page