mohawk

What it is and what it does

Mohawk is a Python implementation of the Hawk HTTP authorization scheme, which enables two parties to authenticate and sign HTTP messages using a shared secret key. It is based on HTTP MAC access authentication and provides an alternative to OAuth 1.0-style signing. The library is designed to be more intuitive and Pythonic than the Node.js reference implementation, with an API redesigned to reduce security pitfalls.

You would use Mohawk to sign outgoing HTTP requests or validate incoming signed requests in scenarios where you need message-level authentication without relying on TLS alone. It depends only on six for Python 2/3 compatibility, making it lightweight. The package is dormant—no releases since 2019—so it is best suited for maintaining existing integrations rather than starting new projects that require active upstream support.

Use it for:

• Sign API requests to services that require Hawk-based authentication (e.g., Mozilla services).
• Validate incoming HTTP requests signed by a Hawk client in your own API.
• Implement message authentication in microservices that share a secret key.
• Migrate or maintain legacy systems using Hawk authorization without switching to newer schemes.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Mohawk implements the Hawk HTTP authorization scheme, allowing two parties to securely communicate by signing messages with a shared key.

Yes, if you are integrating with an existing Hawk-authenticated service or maintaining legacy code. No, if you are starting a new project—the package is dormant (last release 2019), classifiers only declare support through Python 3.7, and no known vulnerabilities exist but upstream support is absent. Use only when Hawk is a hard requirement imposed by your integration target.

Install

mohawk on PyPI

pip install mohawk

uv add mohawk

poetry add mohawk

Installing mohawk

Before you install

Low install friction with a single lightweight dependency (six). However, the package is dormant—last release was 2019-10-28, over six years ago, though the repository remains active with a recent commit in 2024-08.

License in practice

Licensed under MPL 2.0 (Mozilla Public License), a copyleft license. You may use and modify the code, but derivative works must be distributed under the same license terms.

Quickstart

pip install mohawk

from mohawk import Hawk

# Create a Hawk instance for signing HTTP requests
hawk = Hawk(credentials={'id': 'user', 'key': 'secret'})
# Use hawk to sign requests or validate responses

Verify before relying

• Whether the package works reliably with modern Python versions beyond those listed in classifiers (3.7 is the latest explicitly declared).
• Current compatibility with contemporary HTTP clients and frameworks.
• Whether Hawk specification compliance has diverged from the living spec since the last release.

Package facts

Evidence: mohawk-1.1.0-py3-none-any.whl

Tags

More WWW/HTTP packages