zorin-authority-sdk-python

Server-side verifier for ZAUTH/1 assertions.

from zorin_authority import verify_assertion

payload = verify_assertion(
    assertion,
    broker_public_key_pem,
    aud="admin.example",
    origin="https://admin.example.com",
    challenge=challenge_from_session,
    action="server.restart",
    resource="vps:prod-01",
    phone_public_key_der_hex=enrolled_phone_key,
)

Verification checks the broker signature and the nested phone ZOWNER/1 signature, exact audience/origin/challenge/action/resource, expiry and zauth:<sha256> transaction binding. The expected phone key must already be enrolled for the user/account; do not trust the key carried by the assertion itself.

Source · MIT