---
id: truelayer-signing
version: "0.4.0"
license: Apache-2.0 or MIT
license_treatment: permissive
maintenance: active
---

# truelayer-signing — Produce & verify TrueLayer API requests signatures

License: permissive · Maintenance: active · Downloads: 191.6K/mo

## What it is and what it does

truelayer-signing is a Python library for cryptographic signing and verification of TrueLayer API requests and webhooks. It provides a fluent builder API to construct signed requests using PEM-encoded private keys and to verify incoming webhook signatures using JWKS (JSON Web Key Sets). The library depends only on cryptography and supports Python 3.10 through 3.14.

The package is designed for developers integrating with TrueLayer's API who need to authenticate outbound requests or validate inbound webhook payloads. It handles the low-level cryptographic operations (signing with private keys, verifying with public keys from JWKS) while exposing a straightforward method-chaining interface for building and verifying signed HTTP requests.

Use it for:

- Sign outbound POST requests to TrueLayer API endpoints using a private key and key ID.
- Verify incoming webhook signatures from TrueLayer by extracting and validating the Tl-Signature header.
- Add idempotency keys and custom headers to signed API requests to prevent duplicate processing.
- Validate webhook JWS headers and ensure the key source (jku) is from an allowed TrueLayer domain.
- Integrate TrueLayer payment or open banking flows into a Python backend with request authentication.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Produces and verifies cryptographic signatures for TrueLayer API requests and webhooks using PEM keys and JWKS.

Yes. The package is actively maintained, has no known vulnerabilities, low install friction, and a permissive license. Install it if you are integrating with TrueLayer's API and need to sign requests or verify webhooks; it is the standard tool for this task in Python.

## Install

pip install truelayer-signing
uv add truelayer-signing
poetry add truelayer-signing

## Installing truelayer-signing

Before you install: Low friction: pure Python wheel with a single runtime dependency on cryptography. Active maintenance with a recent release 57 days ago and commits through August 2026.

License in practice: Licensed under Apache-2.0 or MIT (permissive), allowing use in most commercial and open-source projects without significant restrictions.

Quickstart:

pip install truelayer-signing

from truelayer_signing import sign_with_pem, HttpMethod

tl_signature = sign_with_pem(KID, PRIVATE_KEY) \
    .set_method(HttpMethod.POST) \
    .set_path(path) \
    .add_header("Idempotency-Key", key) \
    .set_body(body) \
    .sign()

Requires Python 3.10 or later; cryptography must be installed.

Verify before relying:

- Whether the package handles key rotation or certificate expiry scenarios automatically.
- Performance characteristics when signing or verifying large request bodies.
- Whether webhook verification supports custom header validation beyond the standard Tl-Signature.

## Package facts

- License: Apache-2.0 or MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 191.6K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

truelayer api signature, cryptographic request signing, webhook signature verification, pem key signing, jwks verification, api request authentication, tl-signature header, truelayer-integration, request-signing, webhook-verification

[View on SkillFed](https://skillfed.io/packages/truelayer-signing) · [View on PyPI](https://pypi.org/project/truelayer-signing/)