---
id: py-vapid
version: "1.9.4"
license: MPL-2.0
license_treatment: copyleft
maintenance: active
---

# py-vapid — Simple VAPID header generation library

License: copyleft · Maintenance: active · Downloads: 6.2M/mo

## What it is and what it does

py-vapid is a minimal library for generating VAPID credentials used in WebPush authentication. VAPID is a voluntary standard that allows application servers sending push notifications to self-identify to push service providers. The library generates public/private key pairs and signs VAPID claims (JSON structures containing subscriber email, audience URL, and expiration timestamp) into HTTP headers that push services can verify.

The package works with cryptography as its sole runtime dependency and can be used either as a library in Python code or as a command-line tool (bin/vapid) for key generation and header signing. It handles the required VAPID claim fields (sub, aud, exp) and optional fields, auto-generating expiration timestamps when not specified.

Use it for:

- Generate VAPID key pairs for a WebPush service during initial setup or key rotation
- Sign VAPID claims into HTTP headers before sending push subscription updates to a push service
- Create restricted subscription endpoints by extracting the applicationServerKey for client-side subscription
- Manage VAPID expiration timestamps to prevent replay attacks in push notification workflows

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Generates VAPID (Voluntary Application Server Identification) headers and key pairs for WebPush subscription authentication between application servers and push service providers.

Yes. This is a focused, actively maintained library with low install friction and no known vulnerabilities. Install it if you're building a WebPush notification system and need to authenticate with push service providers. The MPL-2.0 license requires source disclosure of modifications but poses no barrier to typical use.

## Install

pip install py-vapid
uv add py-vapid
poetry add py-vapid

## Installing py-vapid

Before you install: Low install friction with a single runtime dependency (cryptography). Actively maintained with a recent release and no known vulnerabilities.

License in practice: Licensed under MPL-2.0 (copyleft). You must disclose source code modifications and distribute under the same license if you modify and redistribute the package.

Quickstart:

pip install py-vapid

from py_vapid import Vapid01

vapid = Vapid01()
vapid.generate_keys()
headers = vapid.sign({"sub": "mailto:admin@example.com", "aud": "https://push.example.com", "exp": "ExpirationTimestamp"})

Verify before relying:

- Whether the library supports VAPID protocol versions beyond the initial implementation
- Performance characteristics when signing large batches of claims
- Compatibility with specific push service providers and their VAPID requirements

## Package facts

- License: MPL-2.0 (copyleft)
- Python support: unspecified
- Install friction: low
- Maintenance: active
- Downloads: 6.2M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

vapid key generation, webpush authentication headers, push notification signing, vapid claims signing, application server identification, webpush vapid library, push service authentication, webpush, cryptography, authentication

[View on SkillFed](https://skillfed.io/packages/py-vapid) · [View on PyPI](https://pypi.org/project/py-vapid/)