Heimdall SP Validator SDK
Python SDK for Service Providers to validate Agent Identity Framework (AIF) tokens issued by Heimdall-compliant Issuing Entities. Verify agent tokens with cryptographic signature validation, audience checking, and revocation status - ensuring only authorized AI agents can access your services.
Installation
pip install heimdall-sp-validator-sdk
Quick Start
from heimdall_sp_validator_sdk import AIFTokenValidator, AIFValidatorConfig
# Configure validator
config = AIFValidatorConfig(
aif_core_service_url="https://poc.iamheimdall.com",
expected_sp_audiences=["my-service-api"],
expected_issuer_id="aif://poc-heimdall.example.com"
)
validator = AIFTokenValidator(config)
# Validate token
try:
result = await validator.verify_atk(token_string)
print(f"✅ Valid token for user: {result.user_id_from_aid}")
print(f"Permissions: {result.permissions}")
except Exception as e:
print(f"❌ Invalid token: {e}")
Configuration
Environment Variables (Recommended)
Copy .env.example to .env and configure:
AIF_CORE_SERVICE_URL=https://poc.iamheimdall.com
AIF_EXPECTED_ISSUER_ID=aif://poc-heimdall.example.com
AIF_SP_EXPECTED_AUDIENCES=my-service-api,another-service
Use environment-based configuration:
config = AIFValidatorConfig.from_env()
validator = AIFTokenValidator(config)
Configuration Options
| Parameter | Default | Description |
|---|---|---|
aif_core_service_url |
Required | Base URL of AIF core service |
expected_sp_audiences |
Required | Your service audience ID(s) |
expected_issuer_id |
Required | Trusted issuer identifier |
jwks_cache_ttl_seconds |
86400 | JWKS cache duration (24 hours) |
revocation_check_enabled |
true | Enable revocation checking |
revocation_check_timeout_seconds |
5 | Revocation check timeout |
clock_skew_seconds |
60 | Allowed time skew for validation |
MIT License - see LICENSE file for details.
1 maintainer
Metadata
1 maintainer
Release files for heimdall-sp-validator-sdk 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| heimdall_sp_validator_sdk-0.1.0.tar.gz | 16.6 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| heimdall_sp_validator_sdk-0.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 29.9 kB
Release files / heimdall_sp_validator_sdk-0.1.0.tar.gz
| Download URL | heimdall_sp_validator_sdk-0.1.0.tar.gz |
|---|---|
| Size | 16.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
47887ca669e8e206832dc76840870ec38f645400f42047f5d12148b4de15de0a
|
|
BLAKE2b-256 checksum How to use checksums |
90893288fdc2722369dc405c6de8de459619e1d60548960d69029bc00d43c208
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.1.0 CPython/3.12.7
|
Release files / heimdall_sp_validator_sdk-0.1.0-py3-none-any.whl
| Download URL | heimdall_sp_validator_sdk-0.1.0-py3-none-any.whl |
|---|---|
| Size | 13.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
6150f78485955537efda0e35fa5603ef80ac58b3229de64e061503130bd177c1
|
|
BLAKE2b-256 checksum How to use checksums |
5cb6f276bbe72748b1e07c49d9d346928ed393a8124abe139a760e1c5c4f2f06
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.1.0 CPython/3.12.7
|
Security for heimdall-sp-validator-sdk 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
