Registry / auth-security / pyattest

pyattest

JSON →
library1.0.4pypypi✓ verified 85d ago

Pyattest is a Python library that provides a common interface for verifying mobile app attestations from both Google and Apple. It offers a standalone solution, but for full Django integration, including key generation and storage, the companion `django-dreiattest` package is recommended. The library is currently at version 1.0.4 and has an infrequent release cadence, with updates typically including security fixes and dependency updates.

pip install pyattest
INSTALL
IMPORT
SIG · PYATTEST
P
pyattest
auth-securitypythonv1.0.4
Install
4.0s avg
Import
Disk
45MB
Pass rate
10/ 10
Env Coverage10 / 10
glibc
3.93.13
musl
3.93.13
Install & Compatibility
Where this runs
tested against v1.0.4 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.103.920 runs
installs and imports cleanly · install 0.0s · import 0.000s · 46.3MB
glibc
py 3.103.920 runs
installs and imports cleanly · install 4.0s · import 0.000s · 47MB
45MB installed
● package 45MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

GoogleConfig
import pyattest
from pyattest import GoogleConfig

This quickstart demonstrates how to verify a Google Play Integrity API attestation using `pyattest`. It shows the setup of `GooglePlayIntegrityApiConfig` with necessary keys and package name, followed by creating an `Attestation` object and calling its `verify()` method. Ensure to replace placeholder keys and mock data with actual values from your application and secure environment variables.

import os from pyattest import GooglePlayIntegrityApiConfig, Attestation # These would typically come from secure environment variables or a key management system decryption_key = os.environ.get('PYATTEST_DECRYPTION_KEY', 'YOUR_BASE64_DECRYPTION_KEY') verification_key = os.environ.get('PYATTEST_VERIFICATION_KEY', 'YOUR_BASE64_VERIFICATION_KEY') # Mock data for demonstration purposes mock_attest_jwt = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c' mock_nonce = 'sample-nonce-123' mock_apk_package_name = 'ch.dreipol.demo' try: config = GooglePlayIntegrityApiConfig( decryption_key=decryption_key, verification_key=verification_key, apk_package_name=mock_apk_package_name, production=True, allow_non_play_distribution=False, # verify_code_signature_hex must be provided if allow_non_play_distribution is True # required_device_verdict="MEETS_STRONG_INTEGRITY" ) attestation = Attestation( attest=mock_attest_jwt, nonce=mock_nonce, config=config ) is_valid = attestation.verify() # This performs the actual verification print(f"Attestation is valid: {is_valid}") if is_valid: # Once verified, you can access properties like device integrity, account details, etc. # Example: print(attestation.parsed_data.deviceIntegrity.deviceRecognition.deviceVerdict) print("Attestation successfully verified.") else: print("Attestation verification failed.") except Exception as e: print(f"An error occurred during attestation verification: {e}")
Debug
Known issues
gotchaFor full integration with Django, including key generation and storage, users should install and configure the separate `django-dreiattest` library. `pyattest` provides the core attestation verification logic but does not handle Django-specific features like database models or admin integration directly.
fix
Install `django-dreiattest` (if using Django) in addition to `pyattest` and follow its documentation for Django-specific setup: `pip install django-dreiattest`.
affects: All versions
gotchaWhen configuring the Google Play Integrity API, the `allow_non_play_distribution` parameter should generally be `False` for production builds to ensure app integrity. If set to `True`, `verify_code_signature_hex` becomes mandatory and must be the SHA-256 hash of your app's signing identity. Avoid using `allow_non_play_distribution=True` for development builds; instead, set `production=False`.
fix
Review your `GooglePlayIntegrityApiConfig` settings. For production, prioritize `production=True` and `allow_non_play_distribution=False`. If `allow_non_play_distribution=True` is required, always provide `verify_code_signature_hex`. For development, use `production=False`.
affects: All versions
gotchaIt is crucial to call the `attestation.verify()` method and check its return value (or catch exceptions) *before* attempting to access any parsed data or assertion details from the `Attestation` object. Accessing data before successful verification can lead to errors or incorrect assumptions about the attestation's validity.
fix
Always ensure the attestation has been successfully verified, typically by checking the boolean return value of `attestation.verify()`, before proceeding to process or rely on the attestation's data.
affects: All versions
Upgrade
Version history
1.0.4latest on PyPI · released Sep 29, 2025
Audit
Dependencies
django-dreiattestoptionalProvides full Django integration, including key generation and storage, for applications using Django. Pyattest itself works standalone.
Agent activity
22 hits · last 30 days
node
20
OpenAI (training)
1
Resources
pyattest — pip install pyattest · libregistry