Auths Python SDK

Decentralized identity for developers and AI agents. Sign, verify, and manage cryptographic identities with Git-native storage.

Install

pip install auths

Quick start

from auths import Auths

auths = Auths()

# Verify an attestation
result = auths.verify(attestation_json=data, issuer_key=public_key_hex)
print(result.valid)  # True

# Sign bytes
signature = auths.sign(b"hello world", private_key=secret_key_hex)

Identity management

from auths import Auths

auths = Auths(repo_path="~/.auths")

# Create a cryptographic identity
identity = auths.identities.create(label="laptop")
print(identity.did)  # did:keri:EBfd...

# Provision an agent (for CI, MCP servers, etc.)
agent = auths.identities.provision_agent(
    identity.did,
    name="deploy-bot",
    capabilities=["sign"],
)

# Sign using the keychain-stored identity key
sig = auths.sign_as(b"hello world", identity=identity.did)

# Link and manage devices
device = auths.devices.link(identity_did=identity.did, capabilities=["sign"])
auths.devices.revoke(device.did, identity_did=identity.did, note="replaced")

Keyless service-to-service verify

Verify an agent's credential presentation offline against a pinned root — one call, a typed Status enum, no exception for a denial:

from auths import verify_presentation, PresentationStatus

report = verify_presentation(bundle_json)  # the Auths-Presentation request bundle
if report.status is not PresentationStatus.VALID:
    raise PermissionError(f"denied: {report.status}")  # WRONG_AUDIENCE, EXPIRED, …

print(report.subject, report.caps)  # granted holder + capabilities

verify_credential(bundle_json) returns a CredentialReport the same way — e.g. report.status is CredentialStatus.CREDENTIAL_REVOKED carries report.revoked_at. Malformed input returns a typed MALFORMED_REQUEST status; it never raises.

Git commit verification

from auths.git import verify_commit_range

result = verify_commit_range("HEAD~5..HEAD")
for commit in result.commits:
    print(f"{commit.commit_sha}: {'valid' if commit.is_valid else commit.error}")

Time-pinned verification

# Verify an attestation's authenticity at a historical point in time
result = auths.verify(attestation_json=data, issuer_key=key, at="2024-06-15T00:00:00Z")

Capability/role authority is no longer checked at verification time. A capability grant comes from a holder-verified ACDC credential, not the attestation.

Agent auth for MCP / AI frameworks

from auths.agent import AgentAuth

auth = AgentAuth(
    bridge_url="https://bridge.example.com",
    attestation_chain_path=".auths/agent-chain.json",
)
token = auth.get_token(capabilities=["read", "write"])

Error handling

from auths import Auths, VerificationError, NetworkError

auths = Auths()
try:
    result = auths.verify(attestation_json=data, issuer_key=key)
except VerificationError as e:
    print(e.code)     # "expired_attestation"
    print(e.message)  # "Attestation expired at 2024-01-15T..."
except NetworkError as e:
    if e.should_retry:
        pass  # safe to retry

All errors inherit from AuthsError and carry .code, .message, and .context.

Configuration

# Auto-discover (uses ~/.auths)
auths = Auths()

# Explicit repo path
auths = Auths(repo_path="/path/to/identity-repo")

# With passphrase (or set AUTHS_PASSPHRASE env var)
auths = Auths(passphrase="my-secret")

# Headless / CI mode
# Set AUTHS_KEYCHAIN_BACKEND=file for environments without a system keychain

API reference

Type stubs are bundled (py.typed + __init__.pyi). Your editor will show full signatures, docstrings, and return types for all methods.

License

Apache-2.0

Project links

Data verified by PyPI on Jul 18, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.1.16)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for bordumb from gravatar.com bordumb

GitHub Statistics

Data verified by PyPI on Jul 18, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

Apache Software License (Apache-2.0)

Requires

Python >=3.8

Provides Extra

jwt

Tags

identity cryptography did signing verification git keri

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

auths-0.1.7.tar.gz (1.7 MB view details)

Uploaded Source

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

auths-0.1.7-cp38-abi3-win_amd64.whl (7.6 MB view details)

Uploaded CPython 3.8+Windows x86-64

auths-0.1.7-cp38-abi3-musllinux_1_2_x86_64.whl (7.8 MB view details)

Uploaded CPython 3.8+musllinux: musl 1.2+ x86-64

auths-0.1.7-cp38-abi3-musllinux_1_2_aarch64.whl (7.3 MB view details)

Uploaded CPython 3.8+musllinux: musl 1.2+ ARM64

auths-0.1.7-cp38-abi3-manylinux_2_28_x86_64.whl (7.8 MB view details)

Uploaded CPython 3.8+manylinux: glibc 2.28+ x86-64

auths-0.1.7-cp38-abi3-manylinux_2_28_aarch64.whl (7.3 MB view details)

Uploaded CPython 3.8+manylinux: glibc 2.28+ ARM64

auths-0.1.7-cp38-abi3-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl (14.0 MB view details)

Uploaded CPython 3.8+macOS 10.12+ universal2 (ARM64, x86-64)macOS 10.12+ x86-64macOS 11.0+ ARM64

File details

Details for the file auths-0.1.7.tar.gz.

File metadata

  • Download URL: auths-0.1.7.tar.gz
  • Upload date:
  • Size: 1.7 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for auths-0.1.7.tar.gz
Algorithm Hash digest
SHA256 ef9ffa50338c3842c416648744fbf33cee0ce818232ae8dd086a07ffb8b9b983
MD5 69dcdd9d928510f9d35e969fb43f4563
BLAKE2b-256 24404d7567443aee822b630b0059dbeb0e41f3a9a4cdf5245b76857675967874

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.7.tar.gz:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file auths-0.1.7-cp38-abi3-win_amd64.whl.

File metadata

  • Download URL: auths-0.1.7-cp38-abi3-win_amd64.whl
  • Upload date:
  • Size: 7.6 MB
  • Tags: CPython 3.8+, Windows x86-64
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for auths-0.1.7-cp38-abi3-win_amd64.whl
Algorithm Hash digest
SHA256 a47fc90f48033faf2a4bf110713fb404d93dfb710935b7b0ca5c597c684dede3
MD5 4dca0f158f362b8f669414e83e295329
BLAKE2b-256 7d8ed79ae68e5e5d0a47224a2116e705cbf585540b6117c1edf68df3dbf030b3

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.7-cp38-abi3-win_amd64.whl:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file auths-0.1.7-cp38-abi3-musllinux_1_2_x86_64.whl.

File metadata

  • Download URL: auths-0.1.7-cp38-abi3-musllinux_1_2_x86_64.whl
  • Upload date:
  • Size: 7.8 MB
  • Tags: CPython 3.8+, musllinux: musl 1.2+ x86-64
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for auths-0.1.7-cp38-abi3-musllinux_1_2_x86_64.whl
Algorithm Hash digest
SHA256 00cdde526dafe74a6a4b4e2e14489a189944705f69fd56eab503bc1b745bf33b
MD5 550cb336c111a18d126cfcb4de8b33fd
BLAKE2b-256 a5d947a6e9b9d4d0be06392ca9cabd7c4bb122a6b85b903a9a2db094cc396bc1

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.7-cp38-abi3-musllinux_1_2_x86_64.whl:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file auths-0.1.7-cp38-abi3-musllinux_1_2_aarch64.whl.

File metadata

File hashes

Hashes for auths-0.1.7-cp38-abi3-musllinux_1_2_aarch64.whl
Algorithm Hash digest
SHA256 ee0de7ef045668c16efc5e9621ec9803b60aac56cfd62d8a286b3b5bf4cf6fa9
MD5 7fd846481264ef29cc506a0873c36af5
BLAKE2b-256 4254affae9ea689496b38c5f7b5f088c5d892b911a7110505b511fd450f38c70

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.7-cp38-abi3-musllinux_1_2_aarch64.whl:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file auths-0.1.7-cp38-abi3-manylinux_2_28_x86_64.whl.

File metadata

File hashes

Hashes for auths-0.1.7-cp38-abi3-manylinux_2_28_x86_64.whl
Algorithm Hash digest
SHA256 d71e698acccbc14a4a36d66be2978d23479dad953aeb6bcdc591a2150da9b37a
MD5 dabb9cfb56a532fbc8a2cfe7d3ff2c9b
BLAKE2b-256 d5d1b6ec39e5fd6555bd7c6c8b6a6a522d6b36aedf4774eb510da9c7b287d15f

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.7-cp38-abi3-manylinux_2_28_x86_64.whl:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file auths-0.1.7-cp38-abi3-manylinux_2_28_aarch64.whl.

File metadata

File hashes

Hashes for auths-0.1.7-cp38-abi3-manylinux_2_28_aarch64.whl
Algorithm Hash digest
SHA256 20bcb3e1230a942fea9db354fca81c3d98c608acf57f277cbe41a42e0048ff4d
MD5 8cf0e82d018361eb345d4249c4a4a614
BLAKE2b-256 a7829a7071183f3a964769a6b0020b121c78f443412fe566c524e2eb8468440c

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.7-cp38-abi3-manylinux_2_28_aarch64.whl:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file auths-0.1.7-cp38-abi3-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl.

File metadata

File hashes

Hashes for auths-0.1.7-cp38-abi3-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl
Algorithm Hash digest
SHA256 a7f2a925b9e68165c26ce4e44638c438c4160b216bbd2937159d453630fbc5af
MD5 40f9005b3cd8305b712754b685dd0449
BLAKE2b-256 de9417a3abac231e53c281651e314c8c6952b7c85837d038ec1653c7b3da8c57

See more details on using hashes here.

Provenance

The following attestation bundles were made for auths-0.1.7-cp38-abi3-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl:

Publisher: publish-python.yml on auths-dev/auths

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.1.16

7 files

0.1.13

7 files

0.1.12

7 files

0.1.11

7 files

0.1.10

7 files

0.1.9

7 files

0.1.8

7 files

This release

0.1.7 This release

7 files

0.1.6

7 files

0.1.5

7 files

0.1.3

7 files

0.1.2

7 files

0.1.1

7 files

0.1.0

5 files

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page