truelayer-signing

What it is and what it does

truelayer-signing is a Python library for cryptographic signing and verification of TrueLayer API requests and webhooks. It provides a fluent builder API to construct signed requests using PEM-encoded private keys and to verify incoming webhook signatures using JWKS (JSON Web Key Sets). The library depends only on cryptography and supports Python 3.10 through 3.14.

The package is designed for developers integrating with TrueLayer's API who need to authenticate outbound requests or validate inbound webhook payloads. It handles the low-level cryptographic operations (signing with private keys, verifying with public keys from JWKS) while exposing a straightforward method-chaining interface for building and verifying signed HTTP requests.

Use it for:

• Sign outbound POST requests to TrueLayer API endpoints using a private key and key ID.
• Verify incoming webhook signatures from TrueLayer by extracting and validating the Tl-Signature header.
• Add idempotency keys and custom headers to signed API requests to prevent duplicate processing.
• Validate webhook JWS headers and ensure the key source (jku) is from an allowed TrueLayer domain.
• Integrate TrueLayer payment or open banking flows into a Python backend with request authentication.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Produces and verifies cryptographic signatures for TrueLayer API requests and webhooks using PEM keys and JWKS.

Yes. The package is actively maintained, has no known vulnerabilities, low install friction, and a permissive license. Install it if you are integrating with TrueLayer's API and need to sign requests or verify webhooks; it is the standard tool for this task in Python.

Install

truelayer-signing on PyPI

pip install truelayer-signing

uv add truelayer-signing

poetry add truelayer-signing

Installing truelayer-signing

Before you install

Low friction: pure Python wheel with a single runtime dependency on cryptography. Active maintenance with a recent release 57 days ago and commits through August 2026.

License in practice

Licensed under Apache-2.0 or MIT (permissive), allowing use in most commercial and open-source projects without significant restrictions.

Quickstart

pip install truelayer-signing

from truelayer_signing import sign_with_pem, HttpMethod

tl_signature = sign_with_pem(KID, PRIVATE_KEY) \
    .set_method(HttpMethod.POST) \
    .set_path(path) \
    .add_header("Idempotency-Key", key) \
    .set_body(body) \
    .sign()

Requires Python 3.10 or later; cryptography must be installed.

Verify before relying

• Whether the package handles key rotation or certificate expiry scenarios automatically.
• Performance characteristics when signing or verifying large request bodies.
• Whether webhook verification supports custom header validation beyond the standard Tl-Signature.

Package facts

Evidence: truelayer_signing-0.4.0-py3-none-any.whl

Keywords: truelayer

Tags

More Cryptography packages