rootherald
A planned server→server Background-Check client for Python 3.10+. It will mint a challenge, appraise the client's opaque evidence with your rh_sk_ secret key, and return the verdict directly. The API below is a preview of the intended surface — mirroring the shipping @rootherald/node SDK — and is not yet available.
This SDK is planned and not yet available. Until it ships, collect an opaque evidence blob on the device and appraise it server-side with @rootherald/node (or any available server SDK). The API shown below is the planned surface and may change before release.
How it will work
Your keyless client collects an opaque evidence blob and hands it to your backend. Your backend will use this client, authenticated with its rh_sk_ secret, to mint a nonce (issue_challenge) and submit the evidence for appraisal (verify). The verdict is computed by Root Herald and returned to your backend — it never travels through the client, which holds no key. Until the Python client ships, call the two REST endpoints directly (see the reference below) or use a shipping server SDK.
Install (planned)
pip install rootheraldMint a challenge and verify (preview)
The intended surface: construct a client with your secret key, mint a nonce, relay it to your client, then appraise the evidence the client returns.
import os
import rootherald
rh = rootherald.BackgroundCheck(secret_key=os.environ["RH_SECRET_KEY"]) # rh_sk_…
# (a) Mint a nonce; relay challenge.nonce to your client.
challenge = rh.issue_challenge()
# (b) The client posts back its opaque evidence blob. Appraise it.
# Only protocol/auth/quota problems raise — a failing device does not.
result = rh.verify(
evidence,
challenge_id=challenge.challenge_id,
policy="rootherald:builtin:strict-hardware",
)
if result.verdict is not rootherald.Verdict.ALLOW:
raise PermissionError("device rejected")
device_id = result.device["ueid"] # stable device id for account binding