How to Create and Verify an OpenID Connect ID Token in Python

import base64
import hashlib
import hmac
import json
import time
from typing import Optional


def b64url_encode(data: bytes) -> str:
    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("utf-8")


def b64url_decode(data: str) -> bytes:
    padding = "=" * (-len(data) % 4)
    return base64.urlsafe_b64decode(data + padding)


def create_id_token(
    client_id: str,
    issuer: str,
    subject: str,
    secret: str,
    email: Optional[str] = None,
    expiry_seconds: int = 3600,
) -> str:
    header = {"alg": "HS256", "typ": "JWT"}

    now = int(time.time())
    payload = {
        "iss": issuer,
        "sub": subject,
        "aud": client_id,
        "iat": now,
        "exp": now + expiry_seconds,
    }
    if email:
        payload["email"] = email

    header_segment = b64url_encode(json.dumps(header, separators=(",", ":")).encode())
    payload_segment = b64url_encode(json.dumps(payload, separators=(",", ":")).encode())

    signing_input = f"{header_segment}.{payload_segment}".encode()
    signature = hmac.new(secret.encode(), signing_input, hashlib.sha256).digest()
    signature_segment = b64url_encode(signature)

    return f"{header_segment}.{payload_segment}.{signature_segment}"


def verify_id_token(token: str, secret: str) -> dict:
    header_segment, payload_segment, signature_segment = token.split(".")
    signing_input = f"{header_segment}.{payload_segment}".encode()
    expected_signature = hmac.new(secret.encode(), signing_input, hashlib.sha256).digest()
    expected_signature_segment = b64url_encode(expected_signature)

    if not hmac.compare_digest(expected_signature_segment, signature_segment):
        raise ValueError("Signature verification failed")

    payload = json.loads(b64url_decode(payload_segment))
    if payload["exp"] < int(time.time()):
        raise ValueError("Token expired")

    return payload


if __name__ == "__main__":
    secret = "super-secret-key"
    token = create_id_token(
        client_id="my-app",
        issuer="https://auth.example.com",
        subject="user-123",
        secret=secret,
        email="user@example.com",
    )
    print(f"ID Token: {token}")
    print(f"Verified payload: {verify_id_token(token, secret)}")