sign.py

import hashlib                                                                                                                                                                                            
from urllib.parse import urlparse, urlencode, parse_qsl, unquote

SECRET = "s3kr3t!"

# Generation:

url_to_sign = "https://example.com/verify?email=zkitzmiller@grabango.com&auth_level=4"                                                                                                                            

def generate_signature(url):
    hasher = hashlib.new('sha256') 
    hasher.update(SECRET.encode() + url.encode()) 
    return hasher.hexdigest() 


def sign_url(url): 
    return url + "&sig=" + generate_signature(url)

# Verification

def verify_signature(signed_url):
    # parse the url
    parsed = urlparse(signed_url)
    params = dict(parse_qsl(parsed.query))
    # get the signature
    sig = params.pop('sig')

    # generate a signature from provided url (remove signature)
    param_str = unquote(urlencode(params))
    _url = parsed.scheme + "://" + parsed.netloc + parsed.path + "?" + param_str

    # verify against generate_signature
    return generate_signature(_url) == sig

Stub

# service A generates an email and sends a "confirm email link"

def generate_email_confirmation_link(email_address, auth_level=4) -> str:
    url = ""
    return url

# service B handles the link

def verify_url(url) -> bool:
    # example input: https://example.com/verify?email=zkitzmiller@grabango.com&auth_level=4
    return