Reference library

Auth & security at scale

OAuth2, JWT, IAM patterns, secrets rotation, and least-privilege service auth.

6 matches

How to Create and Verify HMAC SHA256 API Signatures in Python

Generate and verify HMAC-SHA256 signatures for API requests using Python's hmac, hashlib, and base64 modules.

import hmac
import hashlib
import base64
import json
from datetime import datetime, timezone

def create_api_signature(secret_key: str, method: str, path: str, timestamp: str, body: dict = None) -> str:
    """Create HMAC-SHA256 signature for API request."""
    payload = {
        "method": method.upper(),
        "p…

14 0 Open

Auth & security at scale medium

How to Encode and Decode JWT with HS256 in Python

Implement JWT encoding and decoding using HMAC-SHA256 (HS256) with Python's standard library, including signature verification.

jwt hmac authentication

Python

import base64
import hashlib
import hmac
import json


def base64url_encode(data: bytes) -> bytes:
    return base64.urlsafe_b64encode(data).rstrip(b"=")


def base64url_decode(data: str) -> bytes:
    padding = "=" * (-len(data) % 4)
    return base64.urlsafe_b64decode(data + padding)


def encode_jwt(payload: dict, …

16 0 Open

Auth & security at scale easy

How to Generate and Verify HMAC Signatures in Python

Create and validate HMAC-SHA256 signatures with a shared secret key using Python's hmac and hashlib modules.

hmac security cryptography

Python

import hashlib
import hmac

SECRET_KEY = b"pepper-secret-2024"

def generate_hmac(message: str) -> str:
    return hmac.new(SECRET_KEY, message.encode("utf-8"), hashlib.sha256).hexdigest()

def verify_hmac(message: str, received_hmac: str) -> bool:
    expected = generate_hmac(message)
    return hmac.compare_digest(e…

15 0 Open

Auth & security at scale medium

How to Implement a CSRF Token Double Submit Mock in Python

A mock CSRF protection class that generates and validates double-submit tokens using HMAC-SHA256 with a secret key.

csrf security hmac

Python

import hmac
import hashlib
import secrets


class CSRFProtection:
    def __init__(self, secret_key: str):
        self.secret_key = secret_key.encode("utf-8")

    def generate_token(self) -> str:
        random_value = secrets.token_hex(16)
        signature = hmac.new(
            self.secret_key, random_value.enco…

13 0 Open

Auth & security at scale easy

How to Verify Passwords in Constant Time in Python

Use hmac.compare_digest to verify passwords in constant time, preventing timing attacks that could reveal password length or character positions.

security authentication timing-attacks

Python

import hmac
import time

# Mock of a constant-time password comparison (prevents timing attacks)
def verify_password(stored_password: str, supplied_password: str) -> bool:
    # hmac.compare_digest runs in constant time (for a given length)
    return hmac.compare_digest(stored_password.encode(), supplied_password.enc…

16 0 Open

Auth & security at scale medium

How to mock Argon2 password hashing in Python

This code demonstrates a mock Argon2 password hasher using HMAC-SHA256 iterations, providing hash and verify methods that mimic Argon2's salted, iterated derivation.

password-hashing security argon2

Python

import hashlib
import hmac
import os


class Argon2Mock:
    def __init__(self, salt_size=16, hash_len=32):
        self.salt_size = salt_size
        self.hash_len = hash_len
        
    def hash(self, password: str, salt: bytes = None) -> str:
        if salt is None:
            salt = os.urandom(self.salt_size)
 …

14 0 Open

Browse by section

Each section groups closely related Python snippets.