pyreqsign

HMAC-based API request signing with environment-bound key derivation for microservices.

Installation

pip install pyreqsign

Quick Start

from pyreqsign import derive_key, sign, verify, sign_request

# Derive a machine-bound signing key from your secret
key = derive_key("my-api-key")

# Sign a canonical message
signature = sign(key, b"POST\n/users\n1714300000\n")
# → base64url signature string

# Verify on the server side
is_valid = verify(key, b"POST\n/users\n1714300000\n", signature)

# Or sign an entire HTTP request (returns headers ready to attach)
headers = sign_request("my-api-key", "POST", "https://api.example.com/v1/data",
                       json_body={"action": "update"})
# → {"Authorization": "EnvSign ES-v2:...", "X-EnvSign-Timestamp": "1714300000", ...}

Why EnvSign?

Standard HMAC signing only binds the secret key. EnvSign additionally binds the signing environment — the derived key depends on both the secret AND the machine fingerprint, making it ideal for:

• Microservice-to-microservice auth where each service instance has a unique identity
• API gateway request validation with replay protection via timestamp binding
• Webhook verification where the sender environment is part of the trust chain

API

Core Signing

All cryptographic operations are implemented in the native extension pyreqsign._native; the Python layer is a thin re-export.

Config Helpers

License

MIT