Registry /
auth-security / mastercard-oauth1-signer
Install & Compatibility
Where this runs
tested against v1.9.2 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.920 runs
installs and imports cleanly · install 0.0s · import 0.000s · 38.8MB
glibcpy 3.10–3.920 runs
installs and imports cleanly · install 3.5s · import 0.000s · 39MB
37MB installed
● package 37MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
Auth
✓ from oauth1 import Auth
✗ from oauth1 import Auth
This quickstart demonstrates how to initialize the `Auth` object with your Mastercard API credentials and use it with the `requests` library to make an authenticated call to a Mastercard API endpoint. Ensure you replace placeholder values with your actual `consumer_key`, `private_key_path`, `key_alias`, and `key_password`.
import requests
import os
from mastercard.oauth1.signer import Auth
# --- Environment variables or placeholder values ---
# Replace with your actual credentials or set as environment variables
CONSUMER_KEY = os.environ.get('MASTERCARD_CONSUMER_KEY', 'YOUR_CONSUMER_KEY')
PRIVATE_KEY_PATH = os.environ.get('MASTERCARD_PRIVATE_KEY_PATH', 'path/to/your/key.p12')
KEY_ALIAS = os.environ.get('MASTERCARD_KEY_ALIAS', 'keyalias') # Alias used when creating the .p12 file
KEY_PASSWORD = os.environ.get('MASTERCARD_KEY_PASSWORD', 'keypassword')
BASE_URL = os.environ.get('MASTERCARD_BASE_URL', 'https://sandbox.api.mastercard.com') # Or 'https://api.mastercard.com'
# --- Load private key and create Auth object ---
try:
# The Auth constructor handles loading the private key from the .p12 file
oauth_auth = Auth(
consumer_key=CONSUMER_KEY,
private_key_path=PRIVATE_KEY_PATH,
private_key_password=KEY_PASSWORD,
private_key_alias=KEY_ALIAS
)
except Exception as e:
print(f"Error initializing Auth: {e}")
print("Please ensure your private key path, password, and alias are correct.")
exit(1)
# --- Example API call (replace with your actual endpoint) ---
# This example assumes an endpoint that returns some data, like a health check or a simple resource.
# The actual endpoint will vary based on the Mastercard API you are using.
api_endpoint = f"{BASE_URL}/some/api/resource"
headers = {'Accept': 'application/json'}
try:
response = requests.get(api_endpoint, auth=oauth_auth, headers=headers)
response.raise_for_status() # Raise an HTTPError for bad responses (4xx or 5xx)
print(f"Successfully called {api_endpoint}")
print(f"Status Code: {response.status_code}")
print("Response Body:")
print(response.json()) # Assuming JSON response
except requests.exceptions.RequestException as e:
print(f"API call failed: {e}")
if hasattr(e, 'response') and e.response is not None:
print(f"Response Status: {e.response.status_code}")
print(f"Response Body: {e.response.text}")
except Exception as e:
print(f"An unexpected error occurred: {e}")
Debug
Known issues
breakingThe `oauth_signature` was not encoded correctly in versions 1.2.0 and 1.3.0, leading to authentication failures for affected API calls. This was resolved in version 1.4.0.fixUpgrade to version 1.4.0 or newer: `pip install mastercard-oauth1-signer --upgrade`.
affects: 1.2.0, 1.3.0
gotchaA critical vulnerability (CVE-2023-49082) was found in Cryptography library version 41.0.0. The `mastercard-oauth1-signer` library explicitly updated its `cryptography` dependency to address this, but if your environment has an older version installed, it could pose a risk.fixEnsure `cryptography` is updated to at least version 42.0.0 or higher. The `mastercard-oauth1-signer` library version 1.8.0 and above include this update. Reinstalling the signer might also update `cryptography`: `pip install mastercard-oauth1-signer --upgrade`.
affects: <1.8.0 (if using Cryptography 41.0.0)
gotchaDependency on `pyOpenSSL` has seen several version bumps and adjustments across releases (e.g., 1.6.0, 1.6.1, 1.7.0, 1.9.0). Users might encounter dependency conflicts or `ImportError` issues if their environment has specific `pyOpenSSL` versions that clash with the library's requirements.fixEnsure a clean virtual environment for your project. If issues persist, try reinstalling `mastercard-oauth1-signer` to force dependency updates: `pip install mastercard-oauth1-signer --upgrade --no-cache-dir`. In isolated cases, manually upgrading `pyOpenSSL` might be necessary: `pip install pyOpenSSL --upgrade`.
affects: All versions, due to varying `pyOpenSSL` requirements over time.
gotchaWhen loading the private key from a `.p12` file, ensure the `private_key_alias` and `private_key_password` are correct. Incorrect values will lead to `MastercardOAuth1SignerException` during `Auth` object initialization.fixDouble-check the alias and password used when generating your `.p12` file. These are case-sensitive. Ensure the file path is correct and readable by the application.
affects: All versions
Upgrade
Version history
1.9.2latest on PyPI · released Apr 13, 2026
Audit
Dependencies
requestsrequiredUsed for making HTTP requests and integrated with the signing mechanism.
cryptographyrequiredCore dependency for cryptographic operations, specifically RSA-SHA256 signing.
pyOpenSSLrequiredHistorically used for SSL functionalities, though its direct use has been reduced over versions.