Signed Message Gateway

A utility for turning JSON payloads into compact signed tokens and verifying them for integrity.

Capabilities

Sign JSON payloads

• Signing a JSON-serializable mapping with a symmetric key and algorithm value of "HS256" returns a compact JWS string that verifies back to the original mapping when checked with the same key. @test
• Custom protected headers (for example, { "kid": "key1" }) provided at signing time are preserved in the token and surfaced when the token is verified. @test

Detect tampering

• Altering any character in the token makes verification fail with a signature validation error. @test

Select key by key ID

• When verifying a token that carries a kid header, the verifier selects the matching key from a provided mapping of key IDs to keys; verification fails if no matching key exists. @test

Implementation

@generates

API

from typing import Any, Dict, Mapping, Optional, Tuple

def sign_payload(payload: Dict[str, Any], key: Any, algorithm: str, headers: Optional[Dict[str, Any]] = None) -> str:
    """Serialize payload as JSON and return a compact JWS using the given algorithm and optional protected headers."""

def verify_payload(token: str, keys: Any | Mapping[str, Any]) -> Tuple[Dict[str, Any], Dict[str, Any]]:
    """Verify the token using a single key or a mapping of key IDs to keys, returning the decoded JSON payload and the protected header."""

Dependencies { .dependencies }

python-jose { .dependency }

Provides JWS signing and verification support for compact JOSE tokens.