py-vapid
Simple VAPID header generation library
Decision gist · record as of 2026-08-14
Yes. This is a focused, actively maintained library with low install friction and no known vulnerabilities. Install it if you're building a WebPush notification system and need to authenticate with push service providers. The MPL-2.0 license requires source disclosure of modifications but poses no barrier to typical use.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Low install friction with a single runtime dependency (cryptography).
- Actively maintained with a recent release and no known vulnerabilities.
License · maintenance · safety
MPL-2.0 (copyleft) — Licensed under MPL-2.0 (copyleft). You must disclose source code modifications and distribute under the same license if you modify and redistribute the package.
last release 2026-01-05 (221 days) · last repo commit 2026-03-31 · 98 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 6,216,733 downloads/mo, #1,957 on PyPI
Alternatives
Verify before relying
pip install py-vapid
from py_vapid import Vapid01
vapid = Vapid01()
vapid.generate_keys()
headers = vapid.sign({"sub": "mailto:admin@example.com", "aud": "https://push.example.com", "exp": "ExpirationTimestamp"})- Whether the library supports VAPID protocol versions beyond the initial implementation
- Performance characteristics when signing large batches of claims
- Compatibility with specific push service providers and their VAPID requirements
What it is and what it does
py-vapid is a minimal library for generating VAPID credentials used in WebPush authentication. VAPID is a voluntary standard that allows application servers sending push notifications to self-identify to push service providers. The library generates public/private key pairs and signs VAPID claims (JSON structures containing subscriber email, audience URL, and expiration timestamp) into HTTP headers that push services can verify.
The package works with cryptography as its sole runtime dependency and can be used either as a library in Python code or as a command-line tool (bin/vapid) for key generation and header signing. It handles the required VAPID claim fields (sub, aud, exp) and optional fields, auto-generating expiration timestamps when not specified.
Use it for
- Generate VAPID key pairs for a WebPush service during initial setup or key rotation
- Sign VAPID claims into HTTP headers before sending push subscription updates to a push service
- Create restricted subscription endpoints by extracting the applicationServerKey for client-side subscription
- Manage VAPID expiration timestamps to prevent replay attacks in push notification workflows
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
This is a focused, actively maintained library with low install friction and no known vulnerabilities. Install it if you're building a WebPush notification system and need to authenticate with push service providers. The MPL-2.0 license requires source disclosure of modifications but poses no barrier to typical use.
Install
py-vapid on PyPI
Before you install
Low install friction with a single runtime dependency (cryptography). Actively maintained with a recent release and no known vulnerabilities.
License in practice
Licensed under MPL-2.0 (copyleft). You must disclose source code modifications and distribute under the same license if you modify and redistribute the package.
Quickstart
pip install py-vapid
from py_vapid import Vapid01
vapid = Vapid01()
vapid.generate_keys()
headers = vapid.sign({"sub": "mailto:admin@example.com", "aud": "https://push.example.com", "exp": "ExpirationTimestamp"})Verify before relying
- Whether the library supports VAPID protocol versions beyond the initial implementation
- Performance characteristics when signing large batches of claims
- Compatibility with specific push service providers and their VAPID requirements
Package facts
| License | MPL-2.0 copyleft |
| Python support | Not specified |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 1 packagecryptography |
| Maintenance | Actively maintained 221 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 6,216,733 / month, #1,957 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Programming Language :: PythonProgramming Language :: Python :: 3Topic :: Internet :: WWW/HTTP |
Evidence: py_vapid-1.9.4-py2.py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “vapid key generation”
- py-vapidGenerates VAPID (Voluntary Application Server Identification) headers…
- pywebpushEncrypts and sends web push notifications to browser push services…
- diffiehellmanlibGenerates Diffie-Hellman key exchange parameters and performs shared…
Give your agent the search over MCP, or paste the wish link into any chat.
More WWW/HTTP packages
urllib3 is an HTTP client library that provides thread-safe connection pooling, SSL/TLS verification, multipart file uploads, request retries, compression support, and proxy handling for Python applications.
Requests is a Python HTTP library that simplifies sending HTTP/1.1 requests with automatic handling of headers, authentication, cookies, and response parsing.
h11 is a pure-Python HTTP/1.1 protocol implementation that handles parsing and serializing HTTP messages without any built-in I/O, letting you integrate it with any network layer you choose.
HTTPX is a fully featured HTTP client library for Python that provides both sync and async APIs, with support for HTTP/1.1 and HTTP/2, plus an integrated command-line client.
Install it if you are building new projects or modernizing existing ones that rely on HTTP.
A minimal low-level HTTP client library that sends HTTP requests with thread-safe and task-safe connection pooling, supporting HTTP/1.1, HTTP/2, proxies, and both sync and async interfaces.
aiohttp is an async HTTP client and server framework built on asyncio, supporting both WebSockets and middleware-based routing for building concurrent web applications.
Install it if you need async HTTP client or server capabilities in asyncio-based applications.
See also pywebpush · django-push-notifications · pypushdeer · py-builder-signing-sdk · auth0-api-python · vonage-jwt · aws-request-signer · django-allauth · apns2-up · jose