10 releases

0.3.1 Jul 15, 2024
0.2.1 Mar 20, 2024
0.1.6 Dec 20, 2022
0.1.5 Aug 15, 2022
0.1.1 Nov 23, 2021

#178 in Cryptography

Download history 1261/week @ 2024-11-15 1355/week @ 2024-11-22 775/week @ 2024-11-29 1235/week @ 2024-12-06 565/week @ 2024-12-13 42/week @ 2024-12-20 118/week @ 2024-12-27 743/week @ 2025-01-03 886/week @ 2025-01-10 1331/week @ 2025-01-17 1061/week @ 2025-01-24 1179/week @ 2025-01-31 1089/week @ 2025-02-07 506/week @ 2025-02-14 765/week @ 2025-02-21 974/week @ 2025-02-28

3,441 downloads per month

MIT/Apache

46KB
920 lines

truelayer-signing

Rust crate to produce & verify TrueLayer API requests signatures.

Crates.io Docs.rs

// `Tl-Signature` value to send with the request.
let tl_signature = truelayer_signing::sign_with_pem(kid, private_key)
    .method(Method::Post)
    .path("/payouts")
    .header("Idempotency-Key", idempotency_key)
    .body(body)
    .build_signer()
    .sign()?;

See full example.

Prerequisites

  • OpenSSL (see here for instructions).

Verifying webhooks

The verify_with_jwks function may be used to verify webhook Tl-Signature header signatures.

// `jku` field is included in webhook signatures
let jku = truelayer_signing::extract_jws_header(webhook_signature)?.jku?;

// check `jku` is an allowed TrueLayer url & fetch jwks JSON (not provided by this lib)
ensure_jku_allowed(jku)?;
let jwks = fetch_jwks(jku);

// jwks may be used directly to verify a signature
truelayer_signing::verify_with_jwks(jwks)
    .method(Method::Post)
    .path(path)
    .headers(all_webhook_headers)
    .body(body)
    .build_verifier()
    .verify(webhook_signature)?;

See webhook server example.

Dependencies

~3–5MB
~99K SLoC