pyreqsign

HMAC-based API request signing with environment-bound key derivation for microservices.

Installation

pip install pyreqsign

Quick Start

from pyreqsign import derive_key, sign, verify, sign_request

# Derive a machine-bound signing key from your secret
key = derive_key("my-api-key")

# Sign a canonical message
signature = sign(key, b"POST\n/users\n1714300000\n")
# → base64url signature string

# Verify on the server side
is_valid = verify(key, b"POST\n/users\n1714300000\n", signature)

# Or sign headers via sign_request — the returned headers include a
# single-use nonce (X-EnvSign-Nonce) that is bound into the signature and
# consumed by the server on first use, so replayed requests are rejected.
# Attach every returned header to your HTTP call (the json_body you pass
# is bound into the signature so a server can detect tampering; you send
# the body yourself).
headers = sign_request("my-api-key", "POST", "https://api.example.com/v1/data",
                       json_body={"action": "update"})
# → {"Authorization": "EnvSign ES-v2:...", "X-EnvSign-Timestamp": "1714300000",
#    "X-EnvSign-Nonce": "9f2a...", ...}
#   then: requests.post(url, json={"action": "update"}, headers=headers)

Why EnvSign?

Standard HMAC signing only binds the secret key. EnvSign additionally binds the signing environment — the derived key depends on both the secret AND the machine fingerprint, making it ideal for:

• Microservice-to-microservice auth where each service instance has a unique identity
• API gateway request validation with one-time (nonce) replay protection — every signed request carries a fresh X-EnvSign-Nonce that is bound into the signature and consumed by the server on first use
• Webhook verification where the sender environment is part of the trust chain

API

Core Signing

All cryptographic operations are implemented in the native extension pyreqsign._native; the Python layer is a thin re-export.

License

MIT