In the message_bad case you can see that either the message was tampered with or the signature was faked. KeybasePublicKeyVerifyError : signature bad verify ( message_bad, throw_error = True ) Traceback ( most recent call last ). verify ( message_bad ) assert not verified kbase.

verify ( message_good ) assert verified verified = kbase. To learn more about describing responses, see Describing Responses.Message_good = ''' -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello, world! -BEGIN PGP SIGNATURE- Version: GnuPG v1 iQEcBAEBAgAGBQJTWHSVAAoJEO7zMmcMHMCAYpEH/j2hJApaHXSj0ddgbrmUdJ2z vZ5DFDR9syTPHrwtRJLPH7tgdiAtUpyXLoz元21JIR7sExzONl7IKdpH1Qn0y1I/ h6mV0Dm+AAJXWtbn08rDW2WWuW4+EBEy12Cfk2r1rF8KT+g3gcc2wLejSACkf7v+ jKo5SnvIwIMze+Msqjcz/+hbKRdEEoD2zihe6ilMfbR1tCt8GALQVa8YEoHpgkcL MWbXSCgM7Q0gf00kHWa3A8rClW0dzW5kJG+InbymtenaDNwoNlFb6DHUdyF//REx YjJ6qHf7qFwtXPBiwrZf+VYt5OnjeWW6ybYasfrJiXi1qnd6IM40QCGlR0UXhII=oUn0 -END PGP SIGNATURE- ''' message_bad = ''' -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello, another world! -BEGIN PGP SIGNATURE- Version: GnuPG v1 iQEcBAEBAgAGBQJTWHSVAAoJEO7zMmcMHMCAYpEH/j2hJApaHXSj0ddgbrmUdJ2z vZ5DFDR9syTPHrwtRJLPH7tgdiAtUpyXLoz元21JIR7sExzONl7IKdpH1Qn0y1I/ h6mV0Dm+AAJXWtbn08rDW2WWuW4+EBEy12Cfk2r1rF8KT+g3gcc2wLejSACkf7v+ jKo5SnvIwIMze+Msqjcz/+hbKRdEEoD2zihe6ilMfbR1tCt8GALQVa8YEoHpgkcL MWbXSCgM7Q0gf00kHWa3A8rClW0dzW5kJG+InbymtenaDNwoNlFb6DHUdyF//REx YjJ6qHf7qFwtXPBiwrZf+VYt5OnjeWW6ybYasfrJiXi1qnd6IM40QCGlR0UXhII=oUn0 -END PGP SIGNATURE- ''' kbase = Keybase ( 'irc' ) verified = kbase. $ref: '#/components/responses/UnauthorizedError'ĭescription: API key is missing or invalid You can define the 401 “Unauthorized” response returned for requests with missing or invalid API key. For more examples, see Using Multiple Authentication Types. Which means either key can be used (as in logical OR). To specify that the keys are used together (as in logical AND), list them in the same array item in the security array: Some APIs use a pair of security keys, say, API Key and App ID. Note that it is possible to support multiple authorization types in an API. This is useful if just a subset of the operations need the API key:ĭescription: OK (successfully authenticated) security can also be set on the operation level instead of globally. Note: The securitySchemes section alone is not enough you must also use security for the API key to have effect. The name ApiKeyAuth is used again in the security section to apply this security scheme to the API. The key name ApiKeyAuth is an arbitrary name for the security scheme (not to be confused with the API key name, which is specified by the name key). This example defines an API key named X-API-Key sent as a request header X-API-Key. ApiKeyAuth: # use the same name as under securitySchemes # 2) Apply the API key globally to all operations Name: X-API-KEY # name of the header, query parameter or cookie In: header # can be 'header', 'query' or 'cookie' In OpenAPI 3.0, API keys are described as follows:ĪpiKeyAuth: # arbitrary name for the security scheme Like Basic authentication, API key-based authentication is only considered secure if used together with other security mechanisms such as HTTPS/SSL. The key can be sent in the query string:ĪPI keys are supposed to be a secret that only the client and server know. An API key is a token that a client provides when making API calls. In both cases, we specify that client canonicalize objects before computing signatures and submitting objects to the server. Some APIs use API keys for authorization. As seen throughout the Keybase API docs, Keybase commands compute signatures over JSON objects (e.g., sig/post.json) and pack cryptographic materials in the Msgpack format (e.g., Keybase-style signatures ). If you use OpenAPI 2.0, see our OpenAPI 2.0 guide.

Keybase api