Python library to verify id tokens using OIDC discovery
OpenID connect identity tokens are a popular choice for federating identity between different systems without the need to share secrets. For example Trusted publishing on PyPI allows use of OIDC tokens created by GitHub or GitLab CI jobs to be used to authenticate when uploading new Python packages. Similarly, OIDC tokens can be used to authenticate to Google Cloud, AWS and Azure from any OIDC identity provider.
The jwt.io and jwt.ms tools allow validating OIDC id tokens without first configuring public keys by means of the OpenID connect discovery protocol.
This library implements the OpenID Connect discovery standard in Python to allow verification of OpenID Connect id tokens without previous configuration of public keys, etc.
Both synchronous and asynchronous (asyncio) implementations are provided.
Example
Suppose you created a GitLab OIDC token as part of a CI job to make an authenticated HTTP GET request to some service:
# .gitlab-ci.yml within https://gitlab.com/my-group/my-project
job_with_id_token:
id_tokens:
ID_TOKEN:
aud: https://my-service.example.com
script:
- curl -X GET -H "Authorization: Bearer $ID_TOKEN" https://my-service.example.com
The following example shows how to verify the OIDC token came from a specific project within a backend implementation:
from typing import Any
from federatedidentity import Issuer, verifiers, verify_id_token
# Use OIDC discovery to fetch public keys for verifying GitLab tokens.
GITLAB_ISSUER = Issuer.from_discovery("https://gitlab.com")
# Expected project path for id token
EXPECTED_PROJECT_PATH = "my-group/my-project"
# Expected audience claim for id token.
EXPECTED_AUDIENCE_CLAIM = "https://my-service.example.com"
def verify_gitlab_token(token: str) -> dict[str, Any]:
"""
Verify an OIDC token from GitLab and return the dictionary of claims. Raises
federatedidentity.exceptions.FederatedIdentityError if the token failed verification.
"""
return verify_id_token(
token,
valid_issuers=[GITLAB_ISSUER],
valid_audiences=[EXPECTED_AUDIENCE_CLAIM],
required_claims=[
# The "project_path" claim must match the expected project.
{"project_path": EXPECTED_PROJECT_PATH},
],
)
See the full documentation for more examples.
1 maintainer
Release files for verify-oidc-identity 0.4.42
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| verify_oidc_identity-0.4.42.tar.gz | 7.9 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| verify_oidc_identity-0.4.42-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 18.5 kB
Release files / verify_oidc_identity-0.4.42.tar.gz
| Download URL | verify_oidc_identity-0.4.42.tar.gz |
|---|---|
| Size | 7.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
17ec50d4e6079d1254884a4c526cce4ff0116fa769e59c5085ef39c58f5b7504
|
|
BLAKE2b-256 checksum How to use checksums |
97458466243b018ecc2a3f8f1301fb17aa49d73b52b84898f17bb731e1365649
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on May 21, 2026.
Transparency logRelease files / verify_oidc_identity-0.4.42-py3-none-any.whl
| Download URL | verify_oidc_identity-0.4.42-py3-none-any.whl |
|---|---|
| Size | 10.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
d5afcd6f206bf9915e339c33ea48679b45065ab14b215c18037f6ca207587625
|
|
BLAKE2b-256 checksum How to use checksums |
ce387e999f2027f21e38a6fbf4609fc4c416cb170ac42cc7b720a44172968338
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on May 21, 2026.
Transparency log
