Metadata-Version: 2.4
Name: messh-sdk
Version: 0.1.0
Summary: Sign and verify HTTP requests as a messh identity (Web Bot Auth, RFC 9421, Ed25519)
Author: Mukul Lohar
License-Expression: Apache-2.0
Project-URL: Homepage, https://messh.io
Project-URL: Documentation, https://github.com/messhio/messh/blob/main/sdk/README.md#python-messh-sdk-import-messh
Project-URL: Source, https://github.com/messhio/messh/tree/main/sdk/py
Project-URL: Issues, https://github.com/messhio/messh/issues
Keywords: messh,web-bot-auth,rfc9421,http-message-signatures,ed25519,agents
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security :: Cryptography
Classifier: Topic :: Internet :: WWW/HTTP
Classifier: Typing :: Typed
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: cryptography>=41
Provides-Extra: httpx
Requires-Dist: httpx>=0.24; extra == "httpx"
Provides-Extra: requests
Requires-Dist: requests>=2.28; extra == "requests"
Provides-Extra: fastapi
Requires-Dist: starlette>=0.27; extra == "fastapi"
Dynamic: license-file

# messh for Python

Sign and verify HTTP requests as a [messh](https://messh.io) identity with **Web Bot Auth**: RFC 9421 HTTP Message Signatures, Ed25519, `tag="web-bot-auth"`.

```sh
pip install messh-sdk            # import name: messh
pip install "messh-sdk[httpx]"   # optional httpx auth
```

## Sign (agent)

```python
from messh import Client, key_file

client = Client("mukul", key=key_file("~/.ssh/id_ed25519"))
client.post("https://api.example.com/deploy", json={"env": "staging"})
```

Use the ssh-ed25519 key you published with `messh publish`. The private key never leaves your machine.

## Agents and CI

Configure it with environment variables instead of code: `MESSH_IDENTITY`, `MESSH_KEY` (PEM, or base64 of PEM or PKCS#8 DER) or `MESSH_KEY_FILE`, and `MESSH_REGISTRY`. `whoami` checks the key is published, so a missing `messh publish` fails at startup with `not_published` instead of every API answering 401.

```python
client = Client.from_env()
me = client.whoami()  # PublishedKey(identity, key_name, key_id, fingerprint, agent_url)
```

Passphrase-protected key? Load it into ssh-agent (`ssh-add`) and pass `key=ssh_agent()`.

## Verify (API)

```python
from fastapi import Depends, FastAPI
from messh.verify import Agent, MesshAuthMiddleware, current_agent

app = FastAPI()
app.add_middleware(MesshAuthMiddleware, trust=["mukul"], paths=["/api/"])

@app.post("/api/deploy")
def deploy(agent: Agent = Depends(current_agent)):
    return {"hello": agent.identity}
```

Without a framework: `Verifier(trust=["mukul"]).verify(method, url, headers, body)`.

Full reference (every function, input and error code): https://github.com/messhio/messh/blob/main/sdk/README.md

License: Apache-2.0
