diff --git a/.travis.yml b/.travis.yml
index ddfd0de..71b2c8e 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -2,7 +2,6 @@ language: python
 sudo: false
 cache: pip
 
-install: pip install tox
 matrix:
   include:
     - python: 2.7
@@ -20,7 +19,14 @@ matrix:
     - python: 3.8
       env:
         - TOX_ENV=py38
-script: tox -e $TOX_ENV
+
+install:
+  - pip install tox
+  - "if ! [[ $TRAVIS_PYTHON_VERSION = '2.7' ]]; then pip install mypy; fi"
+
+script:
+  - "if ! [[ $TRAVIS_PYTHON_VERSION = '2.7' ]]; then mypy pylti1p3/ && mypy --py2 pylti1p3/; fi"
+  - tox -e $TOX_ENV
 
 notifications:
   email:
diff --git a/pylintrc b/pylintrc
index 36227dd..7d6f70a 100644
--- a/pylintrc
+++ b/pylintrc
@@ -72,6 +72,10 @@ disable=
 # python2-compatible
     useless-object-inheritance,
 
+# Conditional imports for type checking
+    unused-import,
+    import-error,
+
 [REPORTS]
 
 # Set the output format. Available formats are text, parseable, colorized, msvs
diff --git a/pylti1p3/actions.py b/pylti1p3/actions.py
index bfd13bb..73d2da0 100644
--- a/pylti1p3/actions.py
+++ b/pylti1p3/actions.py
@@ -1,3 +1,9 @@
+import typing as t
+
+if t.TYPE_CHECKING:
+    from typing_extensions import Final
+
+
 class Action(object):
-    OIDC_LOGIN = 'oidc_login'
-    MESSAGE_LAUNCH = 'message_launch'
+    OIDC_LOGIN = 'oidc_login'  # type: Final
+    MESSAGE_LAUNCH = 'message_launch'  # type: Final
diff --git a/pylti1p3/assignments_grades.py b/pylti1p3/assignments_grades.py
index 785c241..8bc9de6 100644
--- a/pylti1p3/assignments_grades.py
+++ b/pylti1p3/assignments_grades.py
@@ -1,16 +1,34 @@
+import typing as t
+
 from .exception import LtiException
 from .lineitem import LineItem
 
+if t.TYPE_CHECKING:
+    from .service_connector import ServiceConnector, _ServiceConnectorResponse
+    from .grade import Grade
+    from mypy_extensions import TypedDict
+    from typing_extensions import Literal
+
+    _AssignmentsGradersData = TypedDict('_AssignmentsGradersData', {
+        'scope': t.List[Literal['https://purl.imsglobal.org/spec/lti-ags/scope/score',
+                                'https://purl.imsglobal.org/spec/lti-ags/scope/lineitem',
+                                'https://purl.imsglobal.org/spec/lti-ags/scope/lineitem.readonly']],
+        'lineitems': str,
+        'lineitem': str,
+    }, total=False)
+
 
 class AssignmentsGradesService(object):
-    _service_connector = None
-    _service_data = None
+    _service_connector = None  # type: ServiceConnector
+    _service_data = None  # type: _AssignmentsGradersData
 
     def __init__(self, service_connector, service_data):
+        # type: (ServiceConnector, _AssignmentsGradersData) -> None
         self._service_connector = service_connector
         self._service_data = service_data
 
     def put_grade(self, grade, line_item=None):
+        # type: (Grade, t.Optional[LineItem]) -> _ServiceConnectorResponse
         if "https://purl.imsglobal.org/spec/lti-ags/scope/score" not in self._service_data['scope']:
             raise LtiException('Missing required scope')
 
@@ -27,6 +45,7 @@ def put_grade(self, grade, line_item=None):
                 line_item = self.find_or_create_lineitem(line_item)
             score_url = line_item.get_id()
 
+        assert score_url is not None
         score_url = self._add_url_path_ending(score_url, 'scores')
         return self._service_connector.make_service_request(
             self._service_data['scope'],
@@ -37,6 +56,7 @@ def put_grade(self, grade, line_item=None):
         )
 
     def get_lineitems(self):
+        # type: () -> list
         if "https://purl.imsglobal.org/spec/lti-ags/scope/lineitem" not in self._service_data['scope']:
             raise LtiException('Missing required scope')
 
@@ -45,9 +65,12 @@ def get_lineitems(self):
             self._service_data['lineitems'],
             accept='application/vnd.ims.lis.v2.lineitemcontainer+json'
         )
+        if not isinstance(line_items['body'], list):
+            raise LtiException('Unknown response type received for line items')
         return line_items['body']
 
     def find_lineitem_by_id(self, ln_id):
+        # type: (t.Optional[str]) -> t.Optional[LineItem]
         line_items = self.get_lineitems()
 
         for line_item in line_items:
@@ -57,6 +80,7 @@ def find_lineitem_by_id(self, ln_id):
         return None
 
     def find_lineitem_by_tag(self, tag):
+        # type: (t.Optional[str]) -> t.Optional[LineItem]
         line_items = self.get_lineitems()
 
         for line_item in line_items:
@@ -66,10 +90,13 @@ def find_lineitem_by_tag(self, tag):
         return None
 
     def find_or_create_lineitem(self, new_line_item, find_by='tag'):
+        # type: (LineItem, Literal['tag', 'id']) -> LineItem
         if find_by == 'tag':
-            line_item = self.find_lineitem_by_tag(new_line_item.get_tag())
+            tag = new_line_item.get_tag()
+            line_item = self.find_lineitem_by_tag(tag)
         elif find_by == 'id':
-            line_item = self.find_lineitem_by_id(new_line_item.get_id())
+            line_id = new_line_item.get_id()
+            line_item = self.find_lineitem_by_id(line_id)
         else:
             raise LtiException('Invalid "find_by" value: ' + str(find_by))
 
@@ -84,28 +111,38 @@ def find_or_create_lineitem(self, new_line_item, find_by='tag'):
             content_type='application/vnd.ims.lis.v2.lineitem+json',
             accept='application/vnd.ims.lis.v2.lineitem+json'
         )
+        if not isinstance(created_line_item['body'], dict):
+            raise LtiException('Unknown response type received for create line item')
         return LineItem(created_line_item['body'])
 
     def get_grades(self, line_item):
+        # type: (LineItem) -> list
         line_item_id = line_item.get_id()
         line_item_tag = line_item.get_tag()
 
-        find_by = None
+        find_by = None  # type: t.Optional[Literal['id', 'tag']]
         if line_item_id:
             find_by = 'id'
         elif line_item_tag:
             find_by = 'tag'
+        else:
+            raise LtiException('Received LineItem did not contain a tag or id')
 
         line_item = self.find_or_create_lineitem(line_item, find_by=find_by)
-        results_url = self._add_url_path_ending(line_item.get_id(), 'results')
+        line_item_id = line_item.get_id()
+        assert line_item_id is not None
+        results_url = self._add_url_path_ending(line_item_id, 'results')
         scores = self._service_connector.make_service_request(
             self._service_data['scope'],
             results_url,
             accept='application/vnd.ims.lis.v2.resultcontainer+json'
         )
+        if not isinstance(scores['body'], list):
+            raise LtiException('Unknown response type received for results')
         return scores['body']
 
     def _add_url_path_ending(self, url, url_path_ending):
+        # type: (str, str) -> str
         if '?' in url:
             url_parts = url.split('?')
             new_url = url_parts[0]
diff --git a/pylti1p3/contrib/django/cookie.py b/pylti1p3/contrib/django/cookie.py
index 16e1e4e..66db5d5 100644
--- a/pylti1p3/contrib/django/cookie.py
+++ b/pylti1p3/contrib/django/cookie.py
@@ -1,15 +1,18 @@
-import django
+import sys
+import typing as t
 
+import django  # type: ignore
 from pylti1p3.cookie import CookieService
-try:
-    import Cookie
-except ImportError:
-    import http.cookies as Cookie
+
+if sys.version_info[0] > 2:
+    import http.cookies as Cookie  # type: ignore
+else:
+    import Cookie  # type: ignore
 
 # Add support for the SameSite attribute (obsolete when PY37 is unsupported).
 # pylint: disable=protected-access
-if 'samesite' not in Cookie.Morsel._reserved:
-    Cookie.Morsel._reserved.setdefault('samesite', 'SameSite')
+if 'samesite' not in Cookie.Morsel._reserved:  # type: ignore
+    Cookie.Morsel._reserved.setdefault('samesite', 'SameSite')  # type: ignore
 
 
 class DjangoCookieService(CookieService):
diff --git a/pylti1p3/contrib/django/launch_data_storage/cache.py b/pylti1p3/contrib/django/launch_data_storage/cache.py
index e1c44f1..8fdf1f8 100644
--- a/pylti1p3/contrib/django/launch_data_storage/cache.py
+++ b/pylti1p3/contrib/django/launch_data_storage/cache.py
@@ -1,4 +1,4 @@
-from django.core.cache import caches
+from django.core.cache import caches  # type: ignore
 from pylti1p3.launch_data_storage.cache import CacheDataStorage
 
 
diff --git a/pylti1p3/contrib/django/lti1p3_tool_config/admin.py b/pylti1p3/contrib/django/lti1p3_tool_config/admin.py
index 8ae8eac..ce15552 100644
--- a/pylti1p3/contrib/django/lti1p3_tool_config/admin.py
+++ b/pylti1p3/contrib/django/lti1p3_tool_config/admin.py
@@ -1,4 +1,6 @@
+# mypy: ignore-errors
 from django.contrib import admin
+
 from .models import LtiTool, LtiToolKey
 
 
diff --git a/pylti1p3/contrib/django/lti1p3_tool_config/apps.py b/pylti1p3/contrib/django/lti1p3_tool_config/apps.py
index 876627f..b7402ce 100644
--- a/pylti1p3/contrib/django/lti1p3_tool_config/apps.py
+++ b/pylti1p3/contrib/django/lti1p3_tool_config/apps.py
@@ -1,4 +1,4 @@
-from django.apps import AppConfig
+from django.apps import AppConfig  # type: ignore
 
 
 class PyLTI1p3ToolConfig(AppConfig):
diff --git a/pylti1p3/contrib/django/lti1p3_tool_config/migrations/0001_initial.py b/pylti1p3/contrib/django/lti1p3_tool_config/migrations/0001_initial.py
index f38ddcd..bd04c68 100644
--- a/pylti1p3/contrib/django/lti1p3_tool_config/migrations/0001_initial.py
+++ b/pylti1p3/contrib/django/lti1p3_tool_config/migrations/0001_initial.py
@@ -1,6 +1,7 @@
+# mypy: ignore-errors
 import django.core.validators
-from django.db import migrations, models
 import django.db.models.deletion
+from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
diff --git a/pylti1p3/contrib/django/lti1p3_tool_config/models.py b/pylti1p3/contrib/django/lti1p3_tool_config/models.py
index 35dac46..d840c77 100644
--- a/pylti1p3/contrib/django/lti1p3_tool_config/models.py
+++ b/pylti1p3/contrib/django/lti1p3_tool_config/models.py
@@ -1,9 +1,10 @@
+# mypy: ignore-errors
 import json
 
-from django.core.validators import URLValidator
 from django.core.exceptions import ValidationError
-from django.utils.translation import ugettext_lazy as _
+from django.core.validators import URLValidator
 from django.db import models
+from django.utils.translation import ugettext_lazy as _
 from pylti1p3.registration import Registration
 
 
diff --git a/pylti1p3/contrib/django/oidc_login.py b/pylti1p3/contrib/django/oidc_login.py
index 5b4c487..df83e20 100644
--- a/pylti1p3/contrib/django/oidc_login.py
+++ b/pylti1p3/contrib/django/oidc_login.py
@@ -1,6 +1,7 @@
-from django.http import HttpResponse
+from django.http import HttpResponse  # type: ignore
 from pylti1p3.oidc_login import OIDCLogin
 from pylti1p3.request import Request
+
 from .cookie import DjangoCookieService
 from .redirect import DjangoRedirect
 from .request import DjangoRequest
diff --git a/pylti1p3/contrib/django/redirect.py b/pylti1p3/contrib/django/redirect.py
index 058c40c..038b612 100644
--- a/pylti1p3/contrib/django/redirect.py
+++ b/pylti1p3/contrib/django/redirect.py
@@ -1,5 +1,5 @@
-from django.http import HttpResponse
-from django.shortcuts import redirect
+from django.http import HttpResponse  # type: ignore
+from django.shortcuts import redirect  # type: ignore
 from pylti1p3.redirect import Redirect
 
 
@@ -8,6 +8,7 @@ class DjangoRedirect(Redirect):
     _cookie_service = None
 
     def __init__(self, location, cookie_service=None):
+        super(DjangoRedirect, self).__init__()
         self._location = location
         self._cookie_service = cookie_service
 
diff --git a/pylti1p3/contrib/django/request.py b/pylti1p3/contrib/django/request.py
index 1f9794f..266a61a 100644
--- a/pylti1p3/contrib/django/request.py
+++ b/pylti1p3/contrib/django/request.py
@@ -6,6 +6,10 @@ class DjangoRequest(Request):
     _post_only = False
     _default_params = None
 
+    @property
+    def session(self):
+        return self._request.session
+
     def __init__(self, request, post_only=False, default_params=None):
         self.set_request(request)
         self._post_only = post_only
diff --git a/pylti1p3/contrib/flask/redirect.py b/pylti1p3/contrib/flask/redirect.py
index 083960b..a92b927 100644
--- a/pylti1p3/contrib/flask/redirect.py
+++ b/pylti1p3/contrib/flask/redirect.py
@@ -8,6 +8,7 @@ class FlaskRedirect(Redirect):
     _cookie_service = None
 
     def __init__(self, location, cookie_service=None):
+        super(FlaskRedirect, self).__init__()
         self._location = location
         self._cookie_service = cookie_service
 
diff --git a/pylti1p3/contrib/flask/request.py b/pylti1p3/contrib/flask/request.py
index b342eeb..b12831c 100644
--- a/pylti1p3/contrib/flask/request.py
+++ b/pylti1p3/contrib/flask/request.py
@@ -1,15 +1,21 @@
-from flask import request, session as flask_session
+import typing as t
 
+from flask import request
+from flask import session as flask_session
 from pylti1p3.request import Request
 
+if t.TYPE_CHECKING:
+    from pylti1p3.request import SessionLike
+
 
 class FlaskRequest(Request):
-    session = None
+    session = None  # type: SessionLike
     _cookies = None
     _request_data = None
     _request_is_secure = None
 
     def __init__(self, cookies=None, session=None, request_data=None, request_is_secure=None):
+        super(FlaskRequest, self).__init__()
         self._cookies = request.cookies if cookies is None else cookies
         self.session = flask_session if session is None else session
         self._request_is_secure = request.is_secure if request_is_secure is None else request_is_secure
diff --git a/pylti1p3/contrib/py.typed b/pylti1p3/contrib/py.typed
new file mode 100644
index 0000000..e69de29
diff --git a/pylti1p3/cookie.py b/pylti1p3/cookie.py
index 161f476..5b94da8 100644
--- a/pylti1p3/cookie.py
+++ b/pylti1p3/cookie.py
@@ -1,14 +1,17 @@
+import typing as t
 from abc import ABCMeta, abstractmethod
 
 
 class CookieService(object):
     __metaclass__ = ABCMeta
-    _cookie_prefix = 'lti1p3'
+    _cookie_prefix = 'lti1p3'  # type: str
 
     @abstractmethod
     def get_cookie(self, name):
+        # type: (str) -> t.Optional[str]
         raise NotImplementedError
 
     @abstractmethod
     def set_cookie(self, name, value, exp=3600):
+        # type: (str, str, int) -> None
         raise NotImplementedError
diff --git a/pylti1p3/cookies_allowed_check.py b/pylti1p3/cookies_allowed_check.py
index 314ff49..7b09d57 100644
--- a/pylti1p3/cookies_allowed_check.py
+++ b/pylti1p3/cookies_allowed_check.py
@@ -1,14 +1,16 @@
 import json
+import typing as t
 
 
 class CookiesAllowedCheckPage(object):
-    _params = {}
-    _protocol = 'http'
-    _main_text = ''
-    _click_text = ''
-    _loading_text = ''
+    _params = {}  # type: t.Mapping[str, str]
+    _protocol = 'http'  # type: str
+    _main_text = ''  # type: str
+    _click_text = ''  # type: str
+    _loading_text = ''  # type: str
 
     def __init__(self, params, protocol, main_text, click_text, loading_text, *args, **kwargs):
+        # type: (t.Mapping[str, str], str, str, str, str, *None, **None) -> None
         # pylint: disable=unused-argument
         self._params = params
         self._protocol = protocol
@@ -17,6 +19,7 @@ def __init__(self, params, protocol, main_text, click_text, loading_text, *args,
         self._loading_text = loading_text
 
     def get_css_block(self):
+        # type: () -> str
         css_block = """\
         body {
         font-family: Geneva, Arial, Helvetica, sans-serif;
@@ -25,6 +28,7 @@ def get_css_block(self):
         return css_block
 
     def get_js_block(self):
+        # type: () -> str
         js_block = """\
         var siteProtocol = '%s';
         var urlParams = %s;
@@ -84,9 +88,11 @@ def get_js_block(self):
         return js_block
 
     def get_header_block(self):
+        # type: () -> str
         return ''
 
     def get_html(self):
+        # type: () -> str
         html = """\
         <!DOCTYPE html>
         <html lang="en">
diff --git a/pylti1p3/deep_link.py b/pylti1p3/deep_link.py
index 5bcd304..419d6a2 100644
--- a/pylti1p3/deep_link.py
+++ b/pylti1p3/deep_link.py
@@ -1,15 +1,44 @@
 import sys
 import time
+import typing as t
 import uuid
-import jwt
+
+import jwt  # type: ignore
+
+if t.TYPE_CHECKING:
+    from .deep_link_resource import DeepLinkResource
+    from .registration import Registration
+    from .deployment import Deployment
+    from typing_extensions import Literal
+    from mypy_extensions import TypedDict
+
+    _DeepLinkData = TypedDict(
+        '_DeepLinkData',
+        {
+            # Required data:
+            'deep_link_return_url': str,
+            'accept_types': t.List[Literal['link', 'ltiResourceLink']],
+            'accept_presentation_document_targets': t.List[
+                Literal['iframe', 'window', 'embed']],
+
+            # Optional data
+            'accept_multiple': t.Union[bool, Literal['true', 'false']],
+            'auto_create': t.Union[bool, Literal['true', 'false']],
+            'title': str,
+            'text': str,
+            'data': object,
+        },
+        total=False,
+    )
 
 
 class DeepLink(object):
-    _registration = None
-    _deployment_id = None
-    _deep_link_settings = None
+    _registration = None  # type: Registration
+    _deployment_id = None  # type: str
+    _deep_link_settings = None  # type: _DeepLinkData
 
     def __init__(self, registration, deployment_id, deep_link_settings):
+        # type: (Registration, str, _DeepLinkData) -> None
         self._registration = registration
         self._deployment_id = deployment_id
         self._deep_link_settings = deep_link_settings
@@ -18,6 +47,7 @@ def _generate_nonce(self):
         return uuid.uuid4().hex + uuid.uuid1().hex
 
     def get_message_jwt(self, resources):
+        # type: (t.Sequence[DeepLinkResource]) -> t.Dict[str, object]
         message_jwt = {
             'iss': self._registration.get_client_id(),
             'aud': [self._registration.get_issuer()],
@@ -42,10 +72,12 @@ def encode_jwt(self, message):
         return encoded_jwt.decode('utf-8') if sys.version_info[0] > 2 else encoded_jwt
 
     def get_response_jwt(self, resources):
+        # type: (t.Sequence[DeepLinkResource]) -> str
         message_jwt = self.get_message_jwt(resources)
         return self.encode_jwt(message_jwt)
 
     def get_response_form_html(self, jwt_val):
+        # type: (str) -> str
         html = '<form id="lti13_deep_link_auto_submit" action="%s" method="POST">' \
                '<input type="hidden" name="JWT" value="%s" /></form>' \
                '<script type="text/javascript">document.getElementById(\'lti13_deep_link_auto_submit\').submit();' \
@@ -53,5 +85,6 @@ def get_response_form_html(self, jwt_val):
         return html
 
     def output_response_form(self, resources):
+        # type: (t.List[DeepLinkResource]) -> str
         jwt_val = self.get_response_jwt(resources)
         return self.get_response_form_html(jwt_val)
diff --git a/pylti1p3/deep_link_resource.py b/pylti1p3/deep_link_resource.py
index aa32e52..9e75475 100644
--- a/pylti1p3/deep_link_resource.py
+++ b/pylti1p3/deep_link_resource.py
@@ -1,64 +1,84 @@
+import typing as t
+
+if t.TYPE_CHECKING:
+    from .lineitem import LineItem
+    T_SELF = t.TypeVar('T_SELF', bound='DeepLinkResource')
+
+
 class DeepLinkResource(object):
-    _type = 'ltiResourceLink'
-    _title = None
-    _url = None
-    _lineitem = None
-    _custom_params = []
-    _target = 'iframe'
+    _type = 'ltiResourceLink'  # type: str
+    _title = None  # type: t.Optional[str]
+    _url = None  # type: t.Optional[str]
+    _lineitem = None  # type: t.Optional[LineItem]
+    _custom_params = {}  # type: t.Mapping[str, str]
+    _target = 'iframe'  # type: str
 
     def get_type(self):
+        # type: () -> str
         return self._type
 
     def set_type(self, value):
+        # type: (T_SELF, str) -> T_SELF
         self._type = value
         return self
 
     def get_title(self):
+        # type: () -> t.Optional[str]
         return self._title
 
     def set_title(self, value):
+        # type: (T_SELF, str) -> T_SELF
         self._title = value
         return self
 
     def get_url(self):
+        # type: () -> t.Optional[str]
         return self._url
 
     def set_url(self, value):
+        # type: (T_SELF, str) -> T_SELF
         self._url = value
         return self
 
     def get_lineitem(self):
+        # type: () -> t.Optional[LineItem]
         return self._lineitem
 
     def set_lineitem(self, value):
+        # type: (T_SELF, LineItem) -> T_SELF
         self._lineitem = value
         return self
 
     def get_custom_params(self):
+        # type: () -> t.Mapping[str, str]
         return self._custom_params
 
     def set_custom_params(self, value):
+        # type: (T_SELF, t.Mapping[str, str]) -> T_SELF
         self._custom_params = value
         return self
 
     def get_target(self):
+        # type: () -> str
         return self._target
 
     def set_target(self, value):
+        # type: (T_SELF, str) -> T_SELF
         self._target = value
         return self
 
     def to_dict(self):
+        # type: () -> t.Dict[str, object]
         res = {
             'type': self._type,
             'title': self._title,
             'url': self._url,
             'custom': self._custom_params
-        }
+        }  # type: t.Dict[str, object]
         if self._lineitem:
             line_item = {
                 'scoreMaximum': self._lineitem.get_score_maximum(),
-            }
+            }  # type: t.Dict[str, object]
 
             label = self._lineitem.get_label()
             if label:
diff --git a/pylti1p3/deployment.py b/pylti1p3/deployment.py
index f44e9a7..6489ce8 100644
--- a/pylti1p3/deployment.py
+++ b/pylti1p3/deployment.py
@@ -1,10 +1,18 @@
+import typing as t
+
+if t.TYPE_CHECKING:
+    T_SELF = t.TypeVar('T_SELF', bound='Deployment')
+
+
 class Deployment(object):
 
-    _deployment_id = None
+    _deployment_id = None  # type: t.Optional[str]
 
     def get_deployment_id(self):
+        # type: () -> t.Optional[str]
         return self._deployment_id
 
     def set_deployment_id(self, deployment_id):
+        # type: (T_SELF, str) -> T_SELF
         self._deployment_id = deployment_id
         return self
diff --git a/pylti1p3/grade.py b/pylti1p3/grade.py
index e8aa55b..2ecc104 100644
--- a/pylti1p3/grade.py
+++ b/pylti1p3/grade.py
@@ -1,56 +1,85 @@
 import json
+import typing as t
+
+if t.TYPE_CHECKING:
+    T_SELF = t.TypeVar('T_SELF', bound='Grade')
+    EXTRA_CLAIMS = t.Mapping[str, t.Any]
 
 
 class Grade(object):
-    _score_given = None
-    _score_maximum = None
-    _activity_progress = None
-    _grading_progress = None
-    _timestamp = None
-    _user_id = None
+    _score_given = None  # type: t.Optional[float]
+    _score_maximum = None  # type: t.Optional[float]
+    _activity_progress = None  # type: t.Optional[str]
+    _grading_progress = None  # type: t.Optional[str]
+    _timestamp = None  # type: t.Optional[str]
+    _user_id = None  # type: t.Optional[str]
+    _extra_claims = None  # type: t.Optional[EXTRA_CLAIMS]
 
     def get_score_given(self):
+        # type: () -> t.Optional[float]
         return self._score_given
 
     def set_score_given(self, value):
+        # type: (T_SELF, float) -> T_SELF
         self._score_given = value
         return self
 
     def get_score_maximum(self):
+        # type: () -> t.Optional[float]
         return self._score_maximum
 
     def set_score_maximum(self, value):
+        # type: (T_SELF, float) -> T_SELF
         self._score_maximum = value
         return self
 
     def get_activity_progress(self):
+        # type: () -> t.Optional[str]
         return self._activity_progress
 
     def set_activity_progress(self, value):
+        # type: (T_SELF, str) -> T_SELF
         self._activity_progress = value
         return self
 
     def get_grading_progress(self):
+        # type: () -> t.Optional[str]
         return self._grading_progress
 
     def set_grading_progress(self, value):
+        # type: (T_SELF, str) -> T_SELF
         self._grading_progress = value
         return self
 
     def get_timestamp(self):
+        # type: () -> t.Optional[str]
         return self._timestamp
 
     def set_timestamp(self, value):
+        # type: (T_SELF, str) -> T_SELF
         self._timestamp = value
         return self
 
     def get_user_id(self):
+        # type: () -> t.Optional[str]
         return self._user_id
 
     def set_user_id(self, value):
+        # type: (T_SELF, str) -> T_SELF
         self._user_id = value
+        return self
+
+    def set_extra_claims(self, value):
+        # type: (T_SELF, EXTRA_CLAIMS) -> T_SELF
+        self._extra_claims = value
+        return self
+
+    def get_extra_claims(self):
+        # type: () -> t.Optional[EXTRA_CLAIMS]
+        return self._extra_claims
 
     def get_value(self):
+        # type: () -> str
         data = {
             'scoreGiven': self._score_given if self._score_given else None,
             'scoreMaximum': self._score_maximum if self._score_maximum else None,
@@ -59,4 +88,7 @@ def get_value(self):
             'timestamp': self._timestamp,
             'userId': self._user_id
         }
+        if self._extra_claims is not None:
+            data.update(self._extra_claims)
+
         return json.dumps({k: v for k, v in data.items() if v is not None})
diff --git a/pylti1p3/launch_data_storage/base.py b/pylti1p3/launch_data_storage/base.py
index 1b8d609..4224fb3 100644
--- a/pylti1p3/launch_data_storage/base.py
+++ b/pylti1p3/launch_data_storage/base.py
@@ -1,32 +1,46 @@
+import typing as t
 from abc import ABCMeta, abstractmethod
 
+if t.TYPE_CHECKING:
+    from ..request import Request
 
-class LaunchDataStorage(object):
+_T_DISABLED_SESSION_ID = t.TypeVar('_T_DISABLED_SESSION_ID', bound='DisableSessionId')
+T = t.TypeVar('T')
+
+
+class LaunchDataStorage(t.Generic[T]):
     __metaclass__ = ABCMeta
-    _request = None
-    _session_id = None
-    _session_cookie_name = 'session-id'
-    _prefix = 'lti1p3-'
+    _request = None  # type: t.Optional[Request]
+    _session_id = None  # type: t.Optional[str]
+    _session_cookie_name = 'session-id'  # type: str
+    _prefix = 'lti1p3-'  # type: str
 
     def __init__(self, *args, **kwargs):
+        # type: (*t.Any, **t.Any) -> None
         pass
 
     def set_request(self, request):
+        # type: (Request) -> None
         self._request = request
 
     def get_session_cookie_name(self):
+        # type: () -> t.Optional[str]
         return self._session_cookie_name
 
     def get_session_id(self):
+        # type: () -> t.Optional[str]
         return self._session_id
 
     def set_session_id(self, session_id):
+        # type: (str) -> None
         self._session_id = session_id
 
     def remove_session_id(self):
+        # type: () -> None
         self._session_id = None
 
     def _prepare_key(self, key):
+        # type: (str) -> str
         if self._session_id:
             if key.startswith(self._prefix):
                 key = key[len(self._prefix):]
@@ -38,35 +52,43 @@ def _prepare_key(self, key):
 
     @abstractmethod
     def can_set_keys_expiration(self):
+        # type: () -> bool
         raise NotImplementedError
 
     @abstractmethod
     def get_value(self, key):
+        # type: (str) -> T
         raise NotImplementedError
 
     @abstractmethod
     def set_value(self, key, value, exp=None):
+        # type: (str, T, t.Optional[int]) -> None
         raise NotImplementedError
 
     @abstractmethod
     def check_value(self, key):
+        # type: (str) -> bool
         raise NotImplementedError
 
 
 class DisableSessionId(object):
-    _session_id = None
-    _launch_data_storage = None
+    _session_id = None  # type: t.Optional[str]
+    _launch_data_storage = None  # type: t.Optional[LaunchDataStorage]
 
     def __init__(self, launch_data_storage):
+        # type: (t.Optional[LaunchDataStorage]) -> None
         self._launch_data_storage = launch_data_storage
-        if self._launch_data_storage:
+        if launch_data_storage:
             self._session_id = launch_data_storage.get_session_id()
 
     def __enter__(self):
+        # type: (_T_DISABLED_SESSION_ID) -> _T_DISABLED_SESSION_ID
         if self._launch_data_storage:
             self._launch_data_storage.remove_session_id()
         return self
 
     def __exit__(self, *args):
+        # type: (*t.Any) -> None
         if self._launch_data_storage:
+            assert self._session_id is not None
             self._launch_data_storage.set_session_id(self._session_id)
diff --git a/pylti1p3/launch_data_storage/cache.py b/pylti1p3/launch_data_storage/cache.py
index c742170..993df5a 100644
--- a/pylti1p3/launch_data_storage/cache.py
+++ b/pylti1p3/launch_data_storage/cache.py
@@ -1,10 +1,16 @@
+import typing as t
+
 from .base import LaunchDataStorage
 
+T = t.TypeVar('T')
+
 
-class CacheDataStorage(LaunchDataStorage):
-    _cache = None
+class CacheDataStorage(LaunchDataStorage[T], t.Generic[T]):
+    # This seems a bit strange, I have no idea when this is ever set.
+    _cache = None  # type: t.Any
 
     def get_session_cookie_name(self):
+        # type: () -> t.Optional[str]
         """
         Workaround for the local non-HTTP usage.
         There is odd situation that all cookies become unavailable from some time
@@ -14,21 +20,26 @@ def get_session_cookie_name(self):
         It is less secure because if you know unique launch_id you may get access to launch data,
         but unfortunately there is no other way. So please use HTTPS on production :-)
         """
+        assert self._request is not None, 'Request should be set at this point'
         if not self._request.is_secure():
             return None
         return super(CacheDataStorage, self).get_session_cookie_name()
 
     def get_value(self, key):
+        # type: (str) -> T
         key = self._prepare_key(key)
         return self._cache.get(key)
 
     def set_value(self, key, value, exp=None):
+        # type: (str, T, t.Optional[int]) -> None
         key = self._prepare_key(key)
         self._cache.set(key, value, exp)
 
     def check_value(self, key):
+        # type: (str) -> bool
         key = self._prepare_key(key)
         return self._cache.get(key) is not None
 
     def can_set_keys_expiration(self):
+        # type: () -> bool
         return True
diff --git a/pylti1p3/launch_data_storage/session.py b/pylti1p3/launch_data_storage/session.py
index b37e4a7..89a7ec1 100644
--- a/pylti1p3/launch_data_storage/session.py
+++ b/pylti1p3/launch_data_storage/session.py
@@ -1,22 +1,35 @@
+import typing as t
+
 from .base import LaunchDataStorage
 
+T = t.TypeVar('T')
 
-class SessionDataStorage(LaunchDataStorage):
 
+class SessionDataStorage(LaunchDataStorage[T], t.Generic[T]):
     def get_session_cookie_name(self):
+        # type: () -> None
         return None
 
     def set_session_id(self, session_id):
+        # type: (str) -> None
         pass
 
     def get_value(self, key):
+        # type: (str) -> T
+        assert self._request is not None, 'Request should be set at this point'
         return self._request.session.get(key, None)
 
     def set_value(self, key, value, exp=None):
+        # type: (str, T, t.Optional[int]) -> None
+        # pylint: disable=unused-argument
+        assert self._request is not None, 'Request should be set at this point'
         self._request.session[key] = value
 
     def check_value(self, key):
+        # type: (str) -> bool
+        assert self._request is not None, 'Request should be set at this point'
         return key in self._request.session
 
     def can_set_keys_expiration(self):
+        # type: () -> bool
         return False
diff --git a/pylti1p3/lineitem.py b/pylti1p3/lineitem.py
index c414f71..3539365 100644
--- a/pylti1p3/lineitem.py
+++ b/pylti1p3/lineitem.py
@@ -1,16 +1,21 @@
 import json
+import typing as t
+
+if t.TYPE_CHECKING:
+    T_SELF = t.TypeVar('T_SELF', bound='LineItem')
 
 
 class LineItem(object):
-    _id = None
-    _score_maximum = None
-    _label = None
-    _resource_id = None
-    _tag = None
-    _start_date_time = None
-    _end_date_time = None
+    _id = None  # type: t.Optional[str]
+    _score_maximum = None  # type: t.Optional[float]
+    _label = None  # type: t.Optional[str]
+    _resource_id = None  # type: t.Optional[str]
+    _tag = None  # type: t.Optional[str]
+    _start_date_time = None  # type: t.Optional[str]
+    _end_date_time = None  # type: t.Optional[str]
 
     def __init__(self, lineitem=None):
+        # type: (t.Optional[t.Mapping[str, t.Any]]) -> None
         if not lineitem:
             lineitem = {}
         self._id = lineitem.get("id")
@@ -22,55 +27,70 @@ def __init__(self, lineitem=None):
         self._end_date_time = lineitem.get("endDateTime")
 
     def get_id(self):
+        # type: () -> t.Optional[str]
         return self._id
 
     def set_id(self, value):
+        # type: (T_SELF, str) -> T_SELF
         self._id = value
         return self
 
     def get_label(self):
+        # type: () -> t.Optional[str]
         return self._label
 
     def set_label(self, value):
+        # type: (T_SELF, str) -> T_SELF
         self._label = value
         return self
 
     def get_score_maximum(self):
+        # type: () -> t.Optional[float]
         return self._score_maximum
 
     def set_score_maximum(self, value):
+        # type: (T_SELF, float) -> T_SELF
         self._score_maximum = value
         return self
 
     def get_resource_id(self):
+        # type: () -> t.Optional[str]
         return self._resource_id
 
     def set_resource_id(self, value):
+        # type: (T_SELF, str) -> T_SELF
         self._resource_id = value
         return self
 
     def get_tag(self):
+        # type: () -> t.Optional[str]
         return self._tag
 
     def set_tag(self, value):
+        # type: (T_SELF, str) -> T_SELF
         self._tag = value
         return self
 
     def get_start_date_time(self):
+        # type: () -> t.Optional[str]
         return self._start_date_time
 
     def set_start_date_time(self, value):
+        # type: (T_SELF, str) -> T_SELF
         self._start_date_time = value
         return self
 
     def get_end_date_time(self):
+        # type: () -> t.Optional[str]
         return self._end_date_time
 
     def set_end_date_time(self, value):
+        # type: (T_SELF, str) -> T_SELF
         self._end_date_time = value
         return self
 
     def get_value(self):
+        # type: () -> str
         data = {
             'id': self._id if self._id else None,
             'scoreMaximum': self._score_maximum if self._score_maximum else None,
diff --git a/pylti1p3/message_launch.py b/pylti1p3/message_launch.py
index ff8382b..a2c7ce9 100644
--- a/pylti1p3/message_launch.py
+++ b/pylti1p3/message_launch.py
@@ -2,41 +2,168 @@
 import hashlib
 import json
 import string  # pylint: disable=deprecated-module
-import sys
+import typing as t
 import uuid
 from abc import ABCMeta, abstractmethod
-import jwt
+
+import jwt  # type: ignore
 import requests
-from jwcrypto.jwk import JWK
+from jwcrypto.jwk import JWK  # type: ignore
 
 from .actions import Action
 from .assignments_grades import AssignmentsGradesService
 from .deep_link import DeepLink
 from .exception import LtiException
+from .launch_data_storage.base import DisableSessionId
 from .message_validators import get_validators
 from .names_roles import NamesRolesProvisioningService
 from .service_connector import ServiceConnector
-from .launch_data_storage.base import DisableSessionId
-
-
-class MessageLaunch(object):
+from .utils import encode_on_py3
+
+if t.TYPE_CHECKING:
+    from .launch_data_storage.base import LaunchDataStorage
+    from .registration import Registration, _KeySet
+    from .request import Request
+    from .tool_config import ToolConfAbstract  # pylint: disable=cyclic-import
+    from .session import SessionService
+    from .cookie import CookieService
+    from .deep_link import _DeepLinkData
+    from .names_roles import _NamesAndRolesData
+    from .assignments_grades import _AssignmentsGradersData
+
+    from mypy_extensions import TypedDict
+    from typing_extensions import Literal
+
+    _ResourceLinkClaim = TypedDict('_ResourceLinkClaim', {
+        # Required data
+        'id': str,
+
+        # Optional data
+        'description': str,
+        'title': str,
+    }, total=False)
+
+    _ContextClaim = TypedDict('_ContextClaim', {
+        # Required data
+        'id': str,
+
+        # Optional data
+        'label': str,
+        'title': str,
+        'type': t.List[str],
+    }, total=False)
+
+    _ToolPlatformClaim = TypedDict('_ToolPlatformClaim', {
+        # Required data
+        'guid': str,
+
+        # Optional data
+        'contact_email': str,
+        'description': str,
+        'name': str,
+        'url': str,
+        'product_family_code': str,
+        'version': str,
+    }, total=False)
+
+    _LearningInformationServicesClaim = TypedDict('_LearningInformationServicesClaim', {
+        'person_sourcedid': str,
+        'course_offering_sourcedid': str,
+        'course_section_sourcedid': str,
+    }, total=False)
+
+    _MigrationClaim = TypedDict(
+        '_MigrationClaim', {
+            # Required data
+            'oauth_consumer_key': str,
+
+            # Optional data
+            'oauth_consumer_key_sign': str,
+            'user_id': str,
+            'context_id': str,
+            'tool_consumer_instance_guid ': str,
+            'resource_link_id': str,
+        },
+        total=False,
+    )
+
+    _LaunchData = TypedDict(
+        '_LaunchData', {
+            # Required data
+            'iss': str,
+            'nonce': str,
+            'aud': t.Union[t.List[str], str],
+            'https://purl.imsglobal.org/spec/lti/claim/message_type':
+                Literal['LtiResourceLinkRequest', 'LtiDeepLinkingRequest'],
+            'https://purl.imsglobal.org/spec/lti/claim/version': Literal['1.3.0'],
+            'https://purl.imsglobal.org/spec/lti/claim/deployment_id': str,
+            'https://purl.imsglobal.org/spec/lti/claim/target_link_uri': str,
+            'https://purl.imsglobal.org/spec/lti/claim/resource_link': _ResourceLinkClaim,
+            'https://purl.imsglobal.org/spec/lti/claim/roles': t.List[str],
+            'sub': str,
+
+
+            # Optional data
+            'given_name': str,
+            'family_name': str,
+            'name': str,
+            'email': str,
+            'https://purl.imsglobal.org/spec/lti/claim/context': _ContextClaim,
+            'https://purl.imsglobal.org/spec/lti/claim/lis': _LearningInformationServicesClaim,
+            'https://purl.imsglobal.org/spec/lti/claim/custom': t.Mapping[str, str],
+            'https://purl.imsglobal.org/spec/lti-dl/claim/deep_linking_settings': _DeepLinkData,
+            'https://purl.imsglobal.org/spec/lti-nrps/claim/namesroleservice': _NamesAndRolesData,
+            'https://purl.imsglobal.org/spec/lti-ags/claim/endpoint': _AssignmentsGradersData,
+            'https://purl.imsglobal.org/spec/lti/claim/tool_platform': _ToolPlatformClaim,
+            'https://purl.imsglobal.org/spec/lti/claim/role_scope_mentor': t.List[str],
+            'https://purl.imsglobal.org/spec/lti/claim/lti1p1': _MigrationClaim,
+        },
+        total=False
+    )
+
+    _JwtHeader = TypedDict(
+        '_JwtHeader', {
+            'kid': str,
+            'alg': str,
+        },
+        total=False,
+    )
+
+    _JwtData = TypedDict(
+        '_JwtData', {
+            'header': _JwtHeader,
+            'body': _LaunchData,
+        },
+        total=False
+    )
+
+
+REQ = t.TypeVar('REQ', bound='Request')
+TCONF = t.TypeVar('TCONF', bound='ToolConfAbstract')
+SES = t.TypeVar('SES', bound='SessionService')
+COOK = t.TypeVar('COOK', bound='CookieService')
+T_SELF = t.TypeVar('T_SELF', bound='MessageLaunch')
+
+
+class MessageLaunch(t.Generic[REQ, TCONF, SES, COOK]):
     __metaclass__ = ABCMeta
-    _request = None
-    _tool_config = None
-    _session_service = None
-    _cookie_service = None
-    _jwt = None
-    _jwt_verify_options = None
-    _id_token_hash = None
-    _registration = None
-    _launch_id = None
-    _validated = False
-    _auto_validation = True
-    _restored = False
-    _public_key_cache_data_storage = None
-    _public_key_cache_lifetime = None
+    _request = None  # type: REQ
+    _tool_config = None  # type: TCONF
+    _session_service = None  # type: SES
+    _cookie_service = None  # type: COOK
+    _jwt = None  # type: _JwtData
+    _jwt_verify_options = None  # type: t.Dict[str, bool]
+    _registration = None  # type: t.Optional[Registration]
+    _launch_id = None  # type: str
+    _validated = False  # type: bool
+    _auto_validation = True  # type: bool
+    _restored = False  # type: bool
+    _id_token_hash = None  # type: t.Optional[str]
+    _public_key_cache_data_storage = None  # type: t.Optional[LaunchDataStorage[t.Any]]
+    _public_key_cache_lifetime = None  # type: t.Optional[int]
 
     def __init__(self, request, tool_config, session_service, cookie_service, launch_data_storage=None):
+        # type: (REQ, TCONF, SES, COOK, t.Optional[LaunchDataStorage[t.Any]]) -> None
         self._request = request
         self._tool_config = tool_config
         self._session_service = session_service
@@ -56,45 +183,55 @@ def __init__(self, request, tool_config, session_service, cookie_service, launch
 
     @abstractmethod
     def _get_request_param(self, key):
+        # type: (str) -> t.Any
         raise NotImplementedError
 
     def set_launch_id(self, launch_id):
+        # type: (T_SELF, str) -> T_SELF
         self._launch_id = launch_id
         return self
 
     def set_auto_validation(self, enable):
+        # type: (T_SELF, bool) -> T_SELF
         self._auto_validation = enable
         return self
 
     def set_jwt(self, val):
+        # type: (T_SELF, _JwtData) -> T_SELF
         self._jwt = val
         return self
 
     def set_jwt_verify_options(self, val):
+        # type: (T_SELF, t.Dict[str, bool]) -> T_SELF
         self._jwt_verify_options = val
         return self
 
     def set_restored(self):
+        # type: (T_SELF) -> T_SELF
         self._restored = True
         return self
 
     def get_session_service(self):
+        # type: () -> SES
         return self._session_service
 
     def get_iss(self):
+        # type: () -> str
         iss = self._get_jwt_body().get('iss')
         if not iss:
             raise LtiException('"iss" is empty')
         return iss
 
     def get_client_id(self):
+        # type: () -> str
         jwt_body = self._get_jwt_body()
         aud = jwt_body.get('aud')
-        return aud[0] if isinstance(aud, list) else aud
+        return aud[0] if isinstance(aud, list) else aud  # type: ignore
 
     @classmethod
     def from_cache(cls, launch_id, request, tool_config, session_service=None, cookie_service=None,
                    launch_data_storage=None):
+        # type: (t.Type[T_SELF], str, REQ, TCONF, SES, COOK, t.Optional[LaunchDataStorage[t.Any]]) -> T_SELF
         obj = cls(request, tool_config, session_service=session_service, cookie_service=cookie_service,
                   launch_data_storage=launch_data_storage)
         launch_data = obj.get_session_service().get_launch_data(launch_id)
@@ -107,6 +244,7 @@ def from_cache(cls, launch_id, request, tool_config, session_service=None, cooki
             .validate_registration()
 
     def validate(self):
+        # type: (T_SELF) -> T_SELF
         """
         Validates all aspects of an incoming LTI message launch and caches the launch if successful.
         """
@@ -127,30 +265,42 @@ def validate(self):
             raise
 
     def _get_jwt_body(self):
+        # type: () -> _LaunchData
         if not self._validated and self._auto_validation:
             self.validate()
         return self._jwt.get('body', {})
 
+    def _get_iss(self):
+        # type: () -> str
+        iss = self._get_jwt_body().get('iss')
+        if not iss:
+            raise LtiException('"iss" is empty')
+        return iss
+
     def _get_id_token(self):
+        # type: () -> str
         id_token = self._get_request_param('id_token')
         if not id_token:
             raise LtiException("Missing id_token")
         return id_token
 
     def _get_id_token_hash(self):
+        # type: () -> str
         if not self._id_token_hash:
             id_token = self._get_id_token()
-            id_token_param = id_token.encode('utf-8') if sys.version_info[0] > 2 else id_token
+            id_token_param = encode_on_py3(id_token, 'utf8')
             self._id_token_hash = hashlib.md5(id_token_param).hexdigest()
         return self._id_token_hash
 
     def _get_deployment_id(self):
+        # type: () -> str
         deployment_id = self._get_jwt_body().get('https://purl.imsglobal.org/spec/lti/claim/deployment_id')
         if not deployment_id:
             raise LtiException("deployment_id is not set in jwt body")
         return deployment_id
 
     def has_nrps(self):
+        # type: () -> bool
         """
         Returns whether or not the current launch can use the names and roles service.
 
@@ -160,11 +310,13 @@ def has_nrps(self):
             .get('context_memberships_url', None) is not None
 
     def get_nrps(self):
+        # type: () -> NamesRolesProvisioningService
         """
         Fetches an instance of the names and roles service for the current launch.
 
         :return: NamesRolesProvisioningService
         """
+        assert self._registration is not None, 'Registration not yet set'
         connector = ServiceConnector(self._registration)
         names_role_service = self._get_jwt_body()\
             .get('https://purl.imsglobal.org/spec/lti-nrps/claim/namesroleservice')
@@ -173,6 +325,7 @@ def get_nrps(self):
         return NamesRolesProvisioningService(connector, names_role_service)
 
     def has_ags(self):
+        # type: () -> bool
         """
         Returns whether or not the current launch can use the assignments and grades service.
 
@@ -181,11 +334,13 @@ def has_ags(self):
         return self._get_jwt_body().get('https://purl.imsglobal.org/spec/lti-ags/claim/endpoint', None) is not None
 
     def get_ags(self):
+        # type: () -> AssignmentsGradesService
         """
         Fetches an instance of the assignments and grades service for the current launch.
 
         :return: AssignmentsGradesService
         """
+        assert self._registration is not None, 'Registration not yet set'
         connector = ServiceConnector(self._registration)
         endpoint = self._get_jwt_body() \
             .get('https://purl.imsglobal.org/spec/lti-ags/claim/endpoint')
@@ -194,11 +349,14 @@ def get_ags(self):
         return AssignmentsGradesService(connector, endpoint)
 
     def get_deep_link(self):
+        # type: () -> DeepLink
         """
         Fetches a deep link that can be used to construct a deep linking response.
 
         :return: DeepLink
         """
+        assert self._registration is not None, 'Registration not yet set'
+
         deployment_id = self._get_deployment_id()
         deep_linking_settings = self._get_jwt_body() \
             .get('https://purl.imsglobal.org/spec/lti-dl/claim/deep_linking_settings')
@@ -208,6 +366,7 @@ def get_deep_link(self):
         return DeepLink(self._registration, deployment_id, deep_linking_settings)
 
     def is_deep_link_launch(self):
+        # type: () -> bool
         """
         Returns whether or not the current launch is a deep linking launch.
 
@@ -217,6 +376,7 @@ def is_deep_link_launch(self):
                    .get('https://purl.imsglobal.org/spec/lti/claim/message_type', None) == 'LtiDeepLinkingRequest'
 
     def is_resource_launch(self):
+        # type: () -> bool
         """
         Returns whether or not the current launch is a resource launch.
 
@@ -226,6 +386,7 @@ def is_resource_launch(self):
                    .get('https://purl.imsglobal.org/spec/lti/claim/message_type', None) == 'LtiResourceLinkRequest'
 
     def get_launch_data(self):
+        # type: () -> _LaunchData
         """
         Fetches the decoded body of the JWT used in the current launch.
 
@@ -234,6 +395,7 @@ def get_launch_data(self):
         return self._get_jwt_body()
 
     def get_launch_id(self):
+        # type: () -> str
         """
         Get the unique launch id for the current launch.
 
@@ -242,27 +404,30 @@ def get_launch_id(self):
         return self._launch_id
 
     def get_tool_conf(self):
+        # type: () -> TCONF
         return self._tool_config
 
     def urlsafe_b64decode(self, val):
+        # type: (str) -> str
         remainder = len(val) % 4
         if remainder > 0:
             padlen = 4 - remainder
             val = val + ('=' * padlen)
         if hasattr(str, 'maketrans'):
-            tmp = val.translate(str.maketrans('-_', '+/'))
-            return base64.b64decode(tmp).decode("utf-8")
+            tmp = val.translate(str.maketrans('-_', '+/'))  # type: ignore
+            return base64.b64decode(tmp).decode("utf-8")  # type: ignore
         else:
-            tmp = str(val).translate(string.maketrans('-_', '+/'))
-            return base64.b64decode(tmp)
+            tmp = str(val).translate(string.maketrans('-_', '+/'))  # type: ignore
+            return base64.b64decode(tmp)  # type: ignore
 
     def set_public_key_caching(self, data_storage, cache_lifetime=7200):
+        # type: (LaunchDataStorage[t.Any], int) -> None
         self._public_key_cache_data_storage = data_storage
         self._public_key_cache_lifetime = cache_lifetime
 
     def fetch_public_key(self, key_set_url):
-        cache_key = key_set_url.encode('utf-8') if sys.version_info[0] > 2 else key_set_url
-        cache_key = 'key-set-url-' + hashlib.md5(cache_key).hexdigest()
+        # type: (str) -> _KeySet
+        cache_key = 'key-set-url-' + hashlib.md5(encode_on_py3(key_set_url, 'utf-8')).hexdigest()
 
         with DisableSessionId(self._public_key_cache_data_storage):
             if self._public_key_cache_data_storage:
@@ -284,10 +449,13 @@ def fetch_public_key(self, key_set_url):
                 raise LtiException("Invalid response from " + key_set_url + ". Must be JSON: " + resp.text)
 
     def get_public_key(self):
+        # type: () -> str
+        assert self._registration is not None, 'Registration not yet set'
         public_key_set = self._registration.get_key_set()
         key_set_url = self._registration.get_key_set_url()
 
         if not public_key_set:
+            assert key_set_url is not None, 'If public_key_set is not set, public_set_url should be set'
             if key_set_url.startswith(('http://', 'https://')):
                 public_key_set = self.fetch_public_key(key_set_url)
                 self._registration.set_key_set(public_key_set)
@@ -318,6 +486,7 @@ def get_public_key(self):
         raise LtiException("Unable to find public key")
 
     def validate_state(self):
+        # type: (T_SELF) -> T_SELF
         # Check State for OIDC.
         state_from_request = self._get_request_param('state')
         if not state_from_request:
@@ -333,6 +502,7 @@ def validate_state(self):
         return self
 
     def validate_jwt_format(self):
+        # type: (T_SELF) -> T_SELF
         id_token = self._get_id_token()
         jwt_parts = id_token.split('.')
 
@@ -354,6 +524,7 @@ def validate_jwt_format(self):
         return self
 
     def validate_nonce(self):
+        # type: (T_SELF) -> T_SELF
         nonce = self._get_jwt_body().get('nonce')
         if not nonce:
             raise LtiException('"nonce" is empty')
@@ -365,17 +536,24 @@ def validate_nonce(self):
         return self
 
     def validate_registration(self):
+        # type: (T_SELF) -> T_SELF
         iss = self.get_iss()
         jwt_body = self._get_jwt_body()
         client_id = self.get_client_id()
 
+        # Mypy doesn't support higher kinded types yet so it thinks that all
+        # generic attrs have type `Any`. See issue:
+        # https://github.com/python/mypy/issues/8228
+        config = self._tool_config  # type: ToolConfAbstract[REQ]
+        req = self._request  # type: REQ
+
         # Find registration
-        if self._tool_config.check_iss_has_one_client(iss):
-            self._registration = self._tool_config.find_registration(
-                iss, action=Action.MESSAGE_LAUNCH, request=self._request, jwt_body=jwt_body)
+        if config.check_iss_has_one_client(iss):
+            self._registration = config.find_registration(
+                iss, action=Action.MESSAGE_LAUNCH, request=req, jwt_body=jwt_body)
         else:
-            self._registration = self._tool_config.find_registration_by_params(
-                iss, client_id, action=Action.MESSAGE_LAUNCH, request=self._request, jwt_body=jwt_body)
+            self._registration = config.find_registration_by_params(
+                iss, client_id, action=Action.MESSAGE_LAUNCH, request=req, jwt_body=jwt_body)
 
         if not self._registration:
             raise LtiException('Registration not found.')
@@ -387,6 +565,7 @@ def validate_registration(self):
         return self
 
     def validate_jwt_signature(self):
+        # type: (T_SELF) -> T_SELF
         id_token = self._get_id_token()
 
         # Fetch public key.
@@ -400,21 +579,24 @@ def validate_jwt_signature(self):
         return self
 
     def validate_deployment(self):
+        # type: (T_SELF) -> T_SELF
         iss = self.get_iss()
         client_id = self.get_client_id()
         deployment_id = self._get_deployment_id()
+        tool_config = self._tool_config  # type: ToolConfAbstract
 
         # Find deployment.
-        if self._tool_config.check_iss_has_one_client(iss):
-            deployment = self._tool_config.find_deployment(iss, deployment_id)
+        if tool_config.check_iss_has_one_client(iss):
+            deployment = tool_config.find_deployment(iss, deployment_id)
         else:
-            deployment = self._tool_config.find_deployment_by_params(iss, deployment_id, client_id)
+            deployment = tool_config.find_deployment_by_params(iss, deployment_id, client_id)
         if not deployment:
             raise LtiException("Unable to find deployment")
 
         return self
 
     def validate_message(self):
+        # type: (T_SELF) -> T_SELF
         jwt_body = self._get_jwt_body()
         message_type = jwt_body.get('https://purl.imsglobal.org/spec/lti/claim/message_type', None)
         if not message_type:
@@ -449,10 +631,12 @@ def set_launch_data_storage(self, data_storage):
         return self
 
     def set_launch_data_lifetime(self, time_sec):
+        # type: (T_SELF, int) -> T_SELF
         self._session_service.set_launch_data_lifetime(time_sec)
         return self
 
     def save_launch_data(self):
+        # type: (T_SELF) -> T_SELF
         state_from_request = self._get_request_param('state')
         id_token_hash = self._get_id_token_hash()
 
@@ -461,9 +645,11 @@ def save_launch_data(self):
         return self
 
     def get_params_from_login(self):
+        # type: () -> object
         state = self._get_request_param('state')
         return self._session_service.get_state_params(state)
 
     def check_jwt_body_is_empty(self):
+        # type: () -> bool
         jwt_body = self._get_jwt_body()
         return not jwt_body
diff --git a/pylti1p3/names_roles.py b/pylti1p3/names_roles.py
index cd332c7..ec688e8 100644
--- a/pylti1p3/names_roles.py
+++ b/pylti1p3/names_roles.py
@@ -1,26 +1,52 @@
 import re
+import typing as t
+
+if t.TYPE_CHECKING:
+    from mypy_extensions import TypedDict
+    from .service_connector import ServiceConnector
+    from typing_extensions import Literal
+
+    _NamesAndRolesData = TypedDict('_NamesAndRolesData', {
+        'context_memberships_url': str,
+    }, total=False)
+    _Member = TypedDict('_Member', {
+        'name': str,
+        'status': Literal['Active', 'Inactive', 'Deleted'],
+        'picture': str,
+        'given_name': str,
+        'family_name': str,
+        'middle_name': str,
+        'email': str,
+        'user_id': str,
+        'lis_person_sourcedid': str,
+        'roles': t.List[str],
+        'message': t.Union[t.List[t.Dict[str, object]], t.Dict[str, object]],
+        'lti11_legacy_user_id': t.Optional[str],
+    }, total=False)
 
 
 class NamesRolesProvisioningService(object):
-    _service_connector = None
-    _service_data = None
+    _service_connector = None  # type: ServiceConnector
+    _service_data = None  # type: _NamesAndRolesData
 
     def __init__(self, service_connector, service_data):
+        # type: (ServiceConnector, _NamesAndRolesData) -> None
         self._service_connector = service_connector
         self._service_data = service_data
 
     def get_members(self):
-        members = []
-        next_page = self._service_data['context_memberships_url']
+        # type: () -> t.List[_Member]
+        members = []  # type: t.List[_Member]
+        next_page = self._service_data['context_memberships_url']  # type: t.Union[Literal[False], str]
 
         while next_page:
             page = self._service_connector.make_service_request(
                 ['https://purl.imsglobal.org/spec/lti-nrps/scope/contextmembership.readonly'],
-                next_page,
+                next_page,  # type: ignore
                 accept='application/vnd.ims.lti-nrps.v2.membershipcontainer+json'
             )
 
-            members.extend(page.get('body', {}).get('members', []))
+            members.extend(t.cast(t.Any, page.get('body', {})).get('members', []))
 
             next_page = False
             link_header = page.get('headers', {}).get('link', '')
diff --git a/pylti1p3/oidc_login.py b/pylti1p3/oidc_login.py
index 0c72da3..aebf0f6 100644
--- a/pylti1p3/oidc_login.py
+++ b/pylti1p3/oidc_login.py
@@ -1,31 +1,55 @@
+import typing as t
 import uuid
 from abc import ABCMeta, abstractmethod
-try:
-    from urllib import urlencode
-except ImportError:
-    from urllib.parse import urlencode
 
 from .actions import Action
 from .cookies_allowed_check import CookiesAllowedCheckPage
 from .exception import OIDCException
 
-
-class OIDCLogin(object):
+if t.TYPE_CHECKING:
+    from .cookie import CookieService
+    from .request import Request
+    from .session import SessionService
+    from .redirect import Redirect
+    from .tool_config import ToolConfAbstract
+    from .registration import Registration
+    from .launch_data_storage.base import LaunchDataStorage
+
+    def urlencode(url):
+        # type: (t.Dict[str, str]) -> str
+        return str(url)
+else:
+    try:
+        from urllib import urlencode
+    except ImportError:
+        from urllib.parse import urlencode
+
+RED = t.TypeVar('RED')
+REQ = t.TypeVar('REQ', bound='Request')
+TCONF = t.TypeVar('TCONF', bound='ToolConfAbstract')
+SES = t.TypeVar('SES', bound='SessionService')
+COOK = t.TypeVar('COOK', bound='CookieService')
+
+T_SELF = t.TypeVar('T_SELF', bound='OIDCLogin')
+
+
+class OIDCLogin(t.Generic[REQ, TCONF, SES, COOK, RED]):
     __metaclass__ = ABCMeta
-    _request = None
-    _tool_config = None
-    _session_service = None
-    _cookie_service = None
-    _launch_data_storage = None
-    _registration = None
-
-    _cookies_check = False
-    _cookies_check_loading_text = 'Loading...'
-    _cookies_unavailable_msg_main_text = 'Your browser prohibits to save cookies in the iframes.'
-    _cookies_unavailable_msg_click_text = 'Click here to open content in the new tab.'
-    _state_params = {}
+    _request = None  # type: REQ
+    _tool_config = None  # type: TCONF
+    _session_service = None  # type: SES
+    _cookie_service = None  # type: COOK
+    _launch_data_storage = None  # type: t.Optional[LaunchDataStorage[t.Any]]
+    _registration = None  # type: Registration
+
+    _cookies_check = False  # type: bool
+    _cookies_check_loading_text = 'Loading...'  # type: str
+    _cookies_unavailable_msg_main_text = 'Your browser prohibits to save cookies in the iframes.'  # type: str
+    _cookies_unavailable_msg_click_text = 'Click here to open content in the new tab.'  # type: str
+    _state_params = {}  # type: t.Dict[str, object]
 
     def __init__(self, request, tool_config, session_service, cookie_service, launch_data_storage=None):
+        # type: (REQ, TCONF, SES, COOK, t.Optional[LaunchDataStorage[t.Any]]) -> None
         self._request = request
         self._tool_config = tool_config
         self._session_service = session_service
@@ -34,12 +58,15 @@ def __init__(self, request, tool_config, session_service, cookie_service, launch
 
     @abstractmethod
     def get_redirect(self, url):
+        # type: (str) -> Redirect[RED]
         raise NotImplementedError
 
     def get_response(self, html):  # pylint: disable=unused-argument
-        return ''
+        # type: (str) -> RED
+        return ''  # type: ignore
 
     def get_iss(self):
+        # type: () -> t.Optional[str]
         if self._registration:
             return self._registration.get_issuer()
         return None
@@ -50,19 +77,24 @@ def get_client_id(self):
         return None
 
     def _get_request_param(self, key):
+        # type: (str) -> t.Any
         return self._request.get_param(key)
 
     def _get_uuid(self):
+        # type: () -> str
         return str(uuid.uuid4())
 
     def _generate_nonce(self):
+        # type: () -> str
         return uuid.uuid4().hex + uuid.uuid1().hex
 
     def _is_new_window_request(self):
+        # type: () -> bool
         lti_new_window = self._get_request_param('lti1p3_new_window')
         return bool(lti_new_window)
 
     def _prepare_redirect_url(self, launch_url):
+        # type: (str) -> str
         if not launch_url:
             raise OIDCException("No launch URL configured")
 
@@ -86,12 +118,17 @@ def _prepare_redirect_url(self, launch_url):
             self._session_service.save_state_params(state, self._state_params)
 
         # build Response
+        client_id = self._registration.get_client_id()  # Registered client id
+        assert client_id is not None, 'Client id should not be None'
+        auth_login_url = self._registration.get_auth_login_url()
+        assert auth_login_url is not None, 'Auth login url should not be None'
+
         auth_params = {
             'scope': 'openid',  # OIDC Scope
             'response_type': 'id_token',  # OIDC response is always an id token
             'response_mode': 'form_post',  # OIDC response is always a form post
             'prompt': 'none',  # Don't prompt user on redirect
-            'client_id': self._registration.get_client_id(),  # Registered client id
+            'client_id': client_id,  # Registered client id
             'redirect_uri': launch_url,  # URL to return to after login
             'state': state,  # State to identify browser session
             'nonce': nonce,  # Prevent replay attacks
@@ -104,14 +141,16 @@ def _prepare_redirect_url(self, launch_url):
             # LTI message hint to identify LTI context within the platform
             auth_params['lti_message_hint'] = lti_message_hint
 
-        auth_login_return_url = self._registration.get_auth_login_url() + "?" + urlencode(auth_params)
+        auth_login_return_url = auth_login_url + "?" + urlencode(auth_params)
         return auth_login_return_url
 
     def _prepare_redirect(self, launch_url):
+        # type: (str) -> Redirect[RED]
         auth_login_return_url = self._prepare_redirect_url(launch_url)
         return self.get_redirect(auth_login_return_url)
 
     def redirect(self, launch_url, js_redirect=False):
+        # type: (str, bool) -> RED
         """
         Calculate the redirect location to return to based on an OIDC third party initiated login request.
 
@@ -131,9 +170,11 @@ def redirect(self, launch_url, js_redirect=False):
         return redirect_obj.do_redirect()
 
     def get_redirect_object(self, launch_url):
+        # type: (str) -> Redirect[RED]
         return self._prepare_redirect(launch_url)
 
     def validate_oidc_login(self):
+        # type: () -> Registration
         # validate Issuer
         iss = self._get_request_param('iss')
         if not iss:
@@ -160,6 +201,7 @@ def validate_oidc_login(self):
         return registration
 
     def pass_params_to_launch(self, params):
+        # type: (T_SELF, t.Dict[str, object]) -> T_SELF
         """
         Ability to pass custom params from oidc login to launch.
         """
@@ -167,6 +209,7 @@ def pass_params_to_launch(self, params):
         return self
 
     def enable_check_cookies(self, main_msg=None, click_msg=None, loading_msg=None, **kwargs):
+        # type: (T_SELF, t.Optional[str], t.Optional[str], t.Optional[str], **None) -> T_SELF
         # pylint: disable=unused-argument
         self._cookies_check = True
         if main_msg:
@@ -178,10 +221,12 @@ def enable_check_cookies(self, main_msg=None, click_msg=None, loading_msg=None,
         return self
 
     def disable_check_cookies(self):
+        # type: (T_SELF) -> T_SELF
         self._cookies_check = False
         return self
 
     def get_additional_login_params(self):
+        # type: () -> t.List[str]
         """
         You may add additional custom params in your own OIDCLogin class
         :return: list
@@ -189,6 +234,7 @@ def get_additional_login_params(self):
         return []
 
     def get_cookies_allowed_js_check(self):
+        # type: () -> str
         protocol = 'https' if self._request.is_secure() else 'http'
         params_lst = ['iss', 'login_hint', 'target_link_uri', 'lti_message_hint',
                       'lti_deployment_id', 'client_id']
@@ -209,6 +255,7 @@ def get_cookies_allowed_js_check(self):
         return page.get_html()
 
     def set_launch_data_storage(self, data_storage):
+        # type: (T_SELF, LaunchDataStorage[t.Any]) -> T_SELF
         data_storage.set_request(self._request)
         session_cookie_name = data_storage.get_session_cookie_name()
         if session_cookie_name:
@@ -221,5 +268,6 @@ def set_launch_data_storage(self, data_storage):
         return self
 
     def set_launch_data_lifetime(self, time_sec):
+        # type: (T_SELF, int) -> T_SELF
         self._session_service.set_launch_data_lifetime(time_sec)
         return self
diff --git a/pylti1p3/py.typed b/pylti1p3/py.typed
new file mode 100644
index 0000000..e69de29
diff --git a/pylti1p3/redirect.py b/pylti1p3/redirect.py
index ddafadb..468c789 100644
--- a/pylti1p3/redirect.py
+++ b/pylti1p3/redirect.py
@@ -1,21 +1,28 @@
+import typing as t
 from abc import ABCMeta, abstractmethod
 
+T = t.TypeVar('T')
 
-class Redirect(object):
+
+class Redirect(t.Generic[T]):
     __metaclass__ = ABCMeta
 
     @abstractmethod
     def do_redirect(self):
+        # type: () -> T
         raise NotImplementedError
 
     @abstractmethod
     def do_js_redirect(self):
+        # type: () -> T
         raise NotImplementedError
 
     @abstractmethod
     def set_redirect_url(self, location):
+        # type: (str) -> None
         raise NotImplementedError
 
     @abstractmethod
     def get_redirect_url(self):
+        # type: () -> str
         raise NotImplementedError
diff --git a/pylti1p3/registration.py b/pylti1p3/registration.py
index d9854b8..1b480b1 100644
--- a/pylti1p3/registration.py
+++ b/pylti1p3/registration.py
@@ -1,57 +1,83 @@
 import json
-from jwcrypto.jwk import JWK
+import typing as t
+
+from jwcrypto.jwk import JWK  # type: ignore
+
+T_SELF = t.TypeVar('T_SELF', bound='Registration')
+
+
+if t.TYPE_CHECKING:
+    from mypy_extensions import TypedDict
+    _Key = TypedDict('_Key', {'kid': str, 'alg': str}, total=True)
+    _KeySet = TypedDict('_KeySet', {'keys': t.List[_Key]}, total=True)
+    from cryptography.hazmat.primitives.asymmetric.rsa import (
+        RSAPublicKey, RSAPrivateKey
+    )
+    _POSSIBLE_KEYS = t.Union[str, bytes, RSAPrivateKey, RSAPublicKey]
 
 
 class Registration(object):
-    _issuer = None
-    _client_id = None
-    _key_set_url = None
-    _key_set = None
-    _auth_token_url = None
-    _auth_login_url = None
+    _issuer = None  # type: t.Optional[str]
+    _client_id = None  # type: t.Optional[str]
+    _key_set_url = None  # type: t.Optional[str]
+    _key_set = None  # type: t.Optional[_KeySet]
+    _auth_token_url = None  # type: t.Optional[str]
+    _auth_login_url = None  # type: t.Optional[str]
+    _tool_private_key = None  # type: t.Optional[_POSSIBLE_KEYS]
     _auth_audience = None
-    _tool_private_key = None
     _tool_public_key = None
 
     def get_issuer(self):
+        # type: () -> t.Optional[str]
         return self._issuer
 
     def set_issuer(self, issuer):
+        # type: (T_SELF, str) -> T_SELF
         self._issuer = issuer
         return self
 
     def get_client_id(self):
+        # type: () -> t.Optional[str]
         return self._client_id
 
     def set_client_id(self, client_id):
+        # type: (T_SELF, str) -> T_SELF
         self._client_id = client_id
         return self
 
     def get_key_set(self):
+        # type: () -> t.Optional[_KeySet]
         return self._key_set
 
     def set_key_set(self, key_set):
+        # type: (T_SELF, t.Optional[_KeySet]) -> T_SELF
         self._key_set = key_set
         return self
 
     def get_key_set_url(self):
+        # type: () -> t.Optional[str]
         return self._key_set_url
 
     def set_key_set_url(self, key_set_url):
+        # type: (T_SELF, str) -> T_SELF
         self._key_set_url = key_set_url
         return self
 
     def get_auth_token_url(self):
+        # type: () -> t.Optional[str]
         return self._auth_token_url
 
     def set_auth_token_url(self, auth_token_url):
+        # type: (T_SELF, str) -> T_SELF
         self._auth_token_url = auth_token_url
         return self
 
     def get_auth_login_url(self):
+        # type: () -> t.Optional[str]
         return self._auth_login_url
 
     def set_auth_login_url(self, auth_login_url):
+        # type: (T_SELF, str) -> T_SELF
         self._auth_login_url = auth_login_url
         return self
 
@@ -63,9 +89,11 @@ def set_auth_audience(self, auth_audience):
         return self
 
     def get_tool_private_key(self):
+        # type: () -> t.Optional[_POSSIBLE_KEYS]
         return self._tool_private_key
 
     def set_tool_private_key(self, tool_private_key):
+        # type: (T_SELF, _POSSIBLE_KEYS) -> T_SELF
         self._tool_private_key = tool_private_key
         return self
 
@@ -78,6 +106,7 @@ def set_tool_public_key(self, tool_public_key):
 
     @classmethod
     def get_jwk(cls, public_key):
+        # type: (str) -> t.Mapping[str, t.Any]
         jwk_obj = JWK.from_pem(public_key.encode('utf-8'))
         public_jwk = json.loads(jwk_obj.export_public())
         public_jwk['alg'] = 'RS256'
@@ -85,6 +114,7 @@ def get_jwk(cls, public_key):
         return public_jwk
 
     def get_jwks(self):
+        # type: () -> t.List[t.Mapping[str, t.Any]]
         keys = []
         public_key = self.get_tool_public_key()
         if public_key:
@@ -92,6 +122,7 @@ def get_jwks(self):
         return keys
 
     def get_kid(self):
+        # type: () -> t.Optional[str]
         key = self.get_tool_public_key()
         if key:
             jwk = Registration.get_jwk(key)
diff --git a/pylti1p3/request.py b/pylti1p3/request.py
index ef87f19..adcdd5b 100644
--- a/pylti1p3/request.py
+++ b/pylti1p3/request.py
@@ -1,9 +1,47 @@
+import typing as t
 from abc import ABCMeta, abstractmethod
 
+if t.TYPE_CHECKING:
+    from typing_extensions import Protocol
+
+    class SessionLike(Protocol):
+        @t.overload
+        def get(self, key):
+            # type: (str) -> t.Any
+            pass
+
+        @t.overload
+        def get(self, key, default):  # pylint: disable=function-redefined
+            # type: (str, t.Any) -> t.Any
+            pass
+
+        def get(self, key, default=None):  # pylint: disable=function-redefined
+            # type: (str, t.Any) -> t.Any
+            pass
+
+        def __setitem__(self, key, value):
+            # type: (str, t.Any) -> None
+            pass
+
+        def __contains__(self, key):
+            # type: (object) -> bool
+            pass
+
 
 class Request(object):
     __metaclass__ = ABCMeta
 
+    @property
+    def session(self):
+        # type: () -> SessionLike
+        raise NotImplementedError
+
+    @abstractmethod
+    def is_secure(self):
+        # type: () -> bool
+        raise NotImplementedError
+
     @abstractmethod
     def get_param(self, key):
+        # type: (str) -> object
         raise NotImplementedError
diff --git a/pylti1p3/service_connector.py b/pylti1p3/service_connector.py
index 5d8020c..4bf28e1 100644
--- a/pylti1p3/service_connector.py
+++ b/pylti1p3/service_connector.py
@@ -1,29 +1,45 @@
 import hashlib
-import time
 import sys
+import time
+import typing as t
 import uuid
-import jwt
+
+import jwt  # type: ignore
 import requests
 
 from .exception import LtiException
 
+if t.TYPE_CHECKING:
+    from mypy_extensions import TypedDict
+    from .registration import Registration
+
+    _ServiceConnectorResponse = TypedDict('_ServiceConnectorResponse', {
+        'headers': t.Dict[str, str],
+        'body': t.Union[None, int, float, t.List[object], t.Dict[str, object], str],
+    })
+
 
 class ServiceConnector(object):
-    _registration = None
-    _access_tokens = None
+    _registration = None  # type: Registration
+    _access_tokens = None  # type: t.Dict[str, str]
 
     def __init__(self, registration):
+        # type: (Registration) -> None
         self._registration = registration
         self._access_tokens = {}
 
     def get_access_token(self, scopes):
+        # type: (t.Sequence[str]) -> str
+
         # Don't fetch the same key more than once
         scopes = sorted(scopes)
-        scopes_str = '|'.join(scopes)
+        scopes_str = '|'.join(scopes)  # type: str
 
         if sys.version_info[0] > 2:
-            scopes_str = scopes_str.encode('utf-8')
-        scope_key = hashlib.md5(scopes_str).hexdigest()
+            scopes_bytes = scopes_str.encode('utf-8')
+        else:
+            scopes_bytes = scopes_str
+        scope_key = hashlib.md5(scopes_bytes).hexdigest()
 
         if scope_key in self._access_tokens:
             return self._access_tokens[scope_key]
@@ -31,6 +47,7 @@ def get_access_token(self, scopes):
         # Build up JWT to exchange for an auth token
         client_id = self._registration.get_client_id()
         auth_url = self._registration.get_auth_token_url()
+        assert auth_url is not None, 'auth_url should be set at this point'
         auth_audience = self._registration.get_auth_audience()
         aud = auth_audience if auth_audience else auth_url
 
@@ -48,7 +65,9 @@ def get_access_token(self, scopes):
             headers = {'kid': kid}
 
         # Sign the JWT with our private key (given by the platform on registration)
-        jwt_val = jwt.encode(jwt_claim, self._registration.get_tool_private_key(), algorithm='RS256',
+        private_key = self._registration.get_tool_private_key()
+        assert private_key is not None, 'Private key should be set at this point'
+        jwt_val = jwt.encode(jwt_claim, private_key, algorithm='RS256',
                              headers=headers)
 
         auth_request = {
@@ -60,15 +79,23 @@ def get_access_token(self, scopes):
 
         # Make request to get auth token
         r = requests.post(auth_url, data=auth_request)
-        if r.status_code not in (200, 201):
+        if not r.ok:
             raise LtiException('HTTP response [%s]: %s - %s' % (auth_url, str(r.status_code), r.text))
         response = r.json()
 
         self._access_tokens[scope_key] = response['access_token']
         return self._access_tokens[scope_key]
 
-    def make_service_request(self, scopes, url, is_post=False, data=None, content_type='application/json',
-                             accept='application/json'):
+    def make_service_request(
+            self,
+            scopes,  # type: t.Sequence[str]
+            url,  # type: str
+            is_post=False,  # type: bool
+            data=None,  # type: t.Union[None, str]
+            content_type='application/json',  # type: str
+            accept='application/json',  # type: str
+    ):
+        # type: (...) -> _ServiceConnectorResponse
         access_token = self.get_access_token(scopes)
         headers = {
             'Authorization': 'Bearer ' + access_token,
@@ -77,7 +104,7 @@ def make_service_request(self, scopes, url, is_post=False, data=None, content_ty
 
         if is_post:
             headers['Content-Type'] = content_type
-            post_data = str(data) if data else None
+            post_data = data or None
             r = requests.post(url, data=post_data, headers=headers)
         else:
             r = requests.get(url, headers=headers)
diff --git a/pylti1p3/session.py b/pylti1p3/session.py
index 0b24677..b77aa90 100644
--- a/pylti1p3/session.py
+++ b/pylti1p3/session.py
@@ -1,53 +1,75 @@
+import typing as t
+from abc import ABCMeta, abstractmethod
+
 from .launch_data_storage.session import SessionDataStorage
 
+if t.TYPE_CHECKING:
+    from .request import Request
+    _JWT_BODY = t.Dict[str, object]
+    _STATE_PARAMS = t.Dict[str, object]
+
 
 class SessionService(object):
-    data_storage = None
-    _launch_data_lifetime = 86400
-    _session_prefix = 'lti1p3'
+    data_storage = None  # type: SessionDataStorage[t.Any]
+    _launch_data_lifetime = 86400  # type: int
+    _session_prefix = 'lti1p3'  # type: str
 
     def __init__(self, request):
+        # type: (Request) -> None
         self.data_storage = SessionDataStorage()
         self.data_storage.set_request(request)
 
     def _get_key(self, key, nonce=None, add_prefix=True):
+        # type: (str, t.Optional[str], bool) -> str
         return ((self._session_prefix + '-') if add_prefix else '') + key + (('-' + nonce) if nonce else '')
 
     def _set_value(self, key, value):
+        # type: (str, object) -> None
         self.data_storage.set_value(key, value, exp=self._launch_data_lifetime)
 
     def _get_value(self, key):
+        # type: (str) -> t.Any
         return self.data_storage.get_value(key)
 
     def get_launch_data(self, key):
+        # type: (str) -> _JWT_BODY
         return self._get_value(self._get_key(key, add_prefix=False))
 
     def save_launch_data(self, key, jwt_body):
+        # type: (str, _JWT_BODY) -> None
         self._set_value(self._get_key(key, add_prefix=False), jwt_body)
 
     def save_nonce(self, nonce):
+        # type: (str) -> None
         self._set_value(self._get_key('nonce', nonce), True)
 
     def check_nonce(self, nonce):
+        # type: (str) -> bool
         nonce_key = self._get_key('nonce', nonce)
         return self.data_storage.check_value(nonce_key)
 
     def save_state_params(self, state, params):
+        # type: (str, _STATE_PARAMS) -> None
         self._set_value(self._get_key(state), params)
 
     def get_state_params(self, state):
+        # type: (str) -> _STATE_PARAMS
         return self._get_value(self._get_key(state))
 
     def set_state_valid(self, state, id_token_hash):
+        # type: (str, str) -> None
         return self._set_value(self._get_key(state + '-id-token-hash'), id_token_hash)
 
     def check_state_is_valid(self, state, id_token_hash):
+        # type: (str, str) -> bool
         return self._get_value(self._get_key(state + '-id-token-hash')) == id_token_hash
 
     def set_data_storage(self, data_storage):
+        # type: (SessionDataStorage[t.Any]) -> None
         self.data_storage = data_storage
 
     def set_launch_data_lifetime(self, time_sec):
+        # type: (int) -> None
         if self.data_storage.can_set_keys_expiration():
             self._launch_data_lifetime = time_sec
         else:
diff --git a/pylti1p3/tool_config/abstract.py b/pylti1p3/tool_config/abstract.py
index e479105..427af99 100644
--- a/pylti1p3/tool_config/abstract.py
+++ b/pylti1p3/tool_config/abstract.py
@@ -1,20 +1,36 @@
 import inspect
 import sys
+import typing as t
 import warnings
 from abc import ABCMeta, abstractmethod
 
+from ..actions import Action
+
+REQ = t.TypeVar('REQ', bound='Request')
+
+if t.TYPE_CHECKING:
+    from ..request import Request
+    from ..registration import Registration
+    from ..deployment import Deployment
+    from ..message_launch import _LaunchData
+    from typing_extensions import Literal, Final
+    FIND_REG_KWARGS = t.Union[Literal['oidc_login', 'message_launch'], REQ,
+                              _LaunchData]
+    PossibleRelationTypes = Literal['one-issuer-one-client-id', 'one-issuer-many-client-ids']
+
 
 class IssuerToClientRelation(object):
-    ONE_CLIENT_ID_PER_ISSUER = 'one-issuer-one-client-id'
-    MANY_CLIENTS_IDS_PER_ISSUER = 'one-issuer-many-client-ids'
+    ONE_CLIENT_ID_PER_ISSUER = 'one-issuer-one-client-id'  # type: Final
+    MANY_CLIENTS_IDS_PER_ISSUER = 'one-issuer-many-client-ids'  # type: Final
 
 
-class ToolConfAbstract(object):
+class ToolConfAbstract(t.Generic[REQ]):
     __metaclass__ = ABCMeta
-    reg_extended_search = False
-    issuers_relation_types = {}
+    reg_extended_search = False  # type: bool
+    issuers_relation_types = {}  # type: t.MutableMapping[str, PossibleRelationTypes]
 
     def __init__(self):
+        # type: () -> None
         if sys.version_info[0] > 2:
             argspec = inspect.getfullargspec(self.find_registration_by_issuer)
             self.reg_extended_search = None not in (argspec.varargs, argspec.varkw)
@@ -23,6 +39,7 @@ def __init__(self):
             self.reg_extended_search = None not in (argspec.varargs, argspec.keywords)
 
     def check_iss_has_one_client(self, iss):
+        # type: (str) -> bool
         """
         Two methods check_iss_has_one_client / check_iss_has_many_clients are needed for the the backward compatibility
         with the previous versions of the library (1.4.0 and early) where ToolConfDict supported only client_id per iss.
@@ -32,6 +49,7 @@ def check_iss_has_one_client(self, iss):
         return iss_type == IssuerToClientRelation.ONE_CLIENT_ID_PER_ISSUER
 
     def check_iss_has_many_clients(self, iss):
+        # type: (str) -> bool
         """
         Should return True for all new ToolConf-s
         """
@@ -39,22 +57,26 @@ def check_iss_has_many_clients(self, iss):
         return iss_type == IssuerToClientRelation.MANY_CLIENTS_IDS_PER_ISSUER
 
     def set_iss_has_one_client(self, iss):
+        # type: (str) -> None
         self.issuers_relation_types[iss] = IssuerToClientRelation.ONE_CLIENT_ID_PER_ISSUER
 
     def set_iss_has_many_clients(self, iss):
+        # type: (str) -> None
         self.issuers_relation_types[iss] = IssuerToClientRelation.MANY_CLIENTS_IDS_PER_ISSUER
 
     def find_registration(self, iss, *args, **kwargs):
+        # type: (str, *None, **FIND_REG_KWARGS) -> t.Optional[Registration]
         if self.reg_extended_search:
             return self.find_registration_by_issuer(iss, *args, **kwargs)
         else:
-            warnings.warn("Signature of ToolConfAbstract.find_registration_by_issuer method was changed, "
-                          "please update you custom implementation",
-                          DeprecationWarning)
+            warnings.warn(
+                "Signature of ToolConfAbstract.find_registration_by_issuer method was changed, "
+                "please update you custom implementation", DeprecationWarning)
             return self.find_registration_by_issuer(iss)
 
     @abstractmethod
     def find_registration_by_issuer(self, iss, *args, **kwargs):
+        # type: (str, *None, **FIND_REG_KWARGS) -> t.Optional[Registration]
         """
         Find registration in case if iss has only one client id, i.e
         in case of { ... "iss": { ... "client_id: "client" ... }, ... } config.
@@ -65,6 +87,7 @@ def find_registration_by_issuer(self, iss, *args, **kwargs):
 
     @abstractmethod
     def find_registration_by_params(self, iss, client_id, *args, **kwargs):
+        # type: (str, str, *None, **FIND_REG_KWARGS) -> t.Optional[Registration]
         """
         Find registration in case if iss has many client ids, i.e
         in case of { ... "iss": [ { ... "client_id: "client1" ... }, { ... "client_id: "client2" ... } ], ... } config.
@@ -76,6 +99,7 @@ def find_registration_by_params(self, iss, client_id, *args, **kwargs):
 
     @abstractmethod
     def find_deployment(self, iss, deployment_id):
+        # type: (str, str) -> t.Optional[Deployment]
         """
         Find deployment in case if iss has only one client id, i.e
         in case of { ... "iss": { ... "client_id: "client" ... }, ... } config.
@@ -86,6 +110,7 @@ def find_deployment(self, iss, deployment_id):
 
     @abstractmethod
     def find_deployment_by_params(self, iss, deployment_id, client_id, *args, **kwargs):
+        # type: (str, str, str, *None, **None) -> t.Optional[Deployment]
         """
         Find deployment in case if iss has many client ids, i.e
         in case of { ... "iss": [ { ... "client_id: "client1" ... }, { ... "client_id: "client2" ... } ], ... } config.
diff --git a/pylti1p3/tool_config/dict.py b/pylti1p3/tool_config/dict.py
index fc4b01e..6f2c6cd 100644
--- a/pylti1p3/tool_config/dict.py
+++ b/pylti1p3/tool_config/dict.py
@@ -1,14 +1,23 @@
-from .abstract import ToolConfAbstract
-from ..registration import Registration
+import typing as t
+
 from ..deployment import Deployment
+from ..registration import Registration
+from ..request import Request
+from .abstract import ToolConfAbstract
+
+if t.TYPE_CHECKING:
+    from ..message_launch import _LaunchData
+    from typing_extensions import Literal
+    from .abstract import FIND_REG_KWARGS
 
 
-class ToolConfDict(ToolConfAbstract):
+class ToolConfDict(ToolConfAbstract[Request]):
     _config = None
-    _private_key = None
-    _public_key = None
+    _private_key = None  # type: t.Optional[t.Mapping[str, str]]
+    _public_key = None  # type: t.Optional[t.Mapping[str, str]]
 
     def __init__(self, json_data):
+        # type: (dict) -> None
         """
         json_data is a dict where each key is issuer and value is issuer's configuration.
         Configuration could be set in two formats:
@@ -73,6 +82,7 @@ def __init__(self, json_data):
         self._public_key = {}
 
     def _validate_iss_config_item(self, iss, iss_config_item):
+        # type: (str, t.Any) -> None
         if not isinstance(iss_config_item, dict):
             raise Exception("Invalid configuration %s for the %s issuer. Must be dict" % (iss, str(iss_config_item)))
         required_keys = ['auth_login_url', 'auth_token_url', 'client_id', 'deployment_ids']
@@ -85,6 +95,7 @@ def _validate_iss_config_item(self, iss, iss_config_item):
                             % (str(iss_config_item), iss))
 
     def _get_registration(self, iss, iss_conf):
+        # type: (str, t.Any) -> Registration
         reg = Registration()
         reg.set_auth_login_url(iss_conf['auth_login_url'])\
             .set_auth_token_url(iss_conf['auth_token_url'])\
@@ -108,10 +119,12 @@ def _get_deployment(self, iss_conf, deployment_id):
         return d.set_deployment_id(deployment_id)
 
     def find_registration_by_issuer(self, iss, *args, **kwargs):
+        # pylint: disable=unused-argument
         iss_conf = self.get_iss_config(iss)
         return self._get_registration(iss, iss_conf)
 
     def find_registration_by_params(self, iss, client_id, *args, **kwargs):
+        # pylint: disable=unused-argument
         iss_conf = self.get_iss_config(iss, client_id)
         return self._get_registration(iss, iss_conf)
 
@@ -120,6 +133,7 @@ def find_deployment(self, iss, deployment_id):
         return self._get_deployment(iss_conf, deployment_id)
 
     def find_deployment_by_params(self, iss, deployment_id, client_id, *args, **kwargs):
+        # pylint: disable=unused-argument
         iss_conf = self.get_iss_config(iss, client_id)
         return self._get_deployment(iss_conf, deployment_id)
 
@@ -174,6 +188,7 @@ def get_iss_config(self, iss, client_id=None):
         return self._config[iss]
 
     def get_jwks(self, iss=None, client_id=None, **kwargs):
+        # pylint: disable=unused-argument
         if iss or client_id:
             return super(ToolConfDict, self).get_jwks(iss, client_id)
 
diff --git a/pylti1p3/tool_config/json_file.py b/pylti1p3/tool_config/json_file.py
index 20a1e3d..e6ad4e5 100644
--- a/pylti1p3/tool_config/json_file.py
+++ b/pylti1p3/tool_config/json_file.py
@@ -1,5 +1,6 @@
 import json
 import os
+
 from .dict import ToolConfDict
 
 
@@ -7,6 +8,7 @@ class ToolConfJsonFile(ToolConfDict):
     _configs_dir = None
 
     def __init__(self, config_file):
+        # type: (str) -> None
         """
         config_file contains JSON with issuers settings.
         Each key is issuer and value is issuer's configuration.
diff --git a/pylti1p3/tool_config/py.typed b/pylti1p3/tool_config/py.typed
new file mode 100644
index 0000000..e69de29
diff --git a/pylti1p3/utils.py b/pylti1p3/utils.py
new file mode 100644
index 0000000..0256843
--- /dev/null
+++ b/pylti1p3/utils.py
@@ -0,0 +1,14 @@
+import sys
+
+if sys.version_info > (2, ):
+
+    def encode_on_py3(arg, encoding):
+        # type: (str, str) -> bytes
+        return arg.encode(encoding)
+
+else:
+
+    def encode_on_py3(arg, encoding):
+        # type: (str, str) -> bytes
+        # pylint: disable=unused-argument
+        return arg
diff --git a/setup.py b/setup.py
index 279850a..aa5edb1 100644
--- a/setup.py
+++ b/setup.py
@@ -2,7 +2,8 @@
 
 import sys
 
-from setuptools import setup, find_packages
+from setuptools import find_packages, setup
+
 from pylti1p3 import __version__
 
 if sys.version_info < (2, 7):
@@ -10,9 +11,23 @@
     print(error, file=sys.stderr)
     sys.exit(1)
 
+
+install_requires = [
+    'pyjwt>=1.5',
+    'jwcrypto',
+    'requests'
+]
+
+if sys.version_info < (3, 5):
+    extra_pkgs = ['typing']
+else:
+    extra_pkgs = []
+
 with open("README.rst", "rt") as readme:
     long_description = readme.read().strip()
 
+packages = find_packages(exclude=["examples", "tests"])
+
 setup(
     name='PyLTI1p3',
     version=__version__,
@@ -22,14 +37,10 @@
     author_email='dmitry.viskov@webenterprise.ru',
     maintainer="Dmitry Viskov",
     long_description=long_description,
-    install_requires=[
-        'pyjwt>=1.5',
-        'jwcrypto',
-        'requests'
-    ],
+    install_requires=install_requires + extra_pkgs,
     license='MIT',
     url='https://github.com/dmitry-viskov/pylti1.3',
-    packages=find_packages(exclude=["tests"]),
+    packages=packages,
     zip_safe=False,
     include_package_data=True,
     classifiers=[
@@ -53,5 +64,10 @@
         "Topic :: Software Development :: Libraries :: Application Frameworks",
         'Topic :: Internet :: WWW/HTTP :: Dynamic Content',
         'Topic :: Software Development :: Libraries :: Python Modules'
-    ]
+    ],
+    package_data={
+        'pylti1p3': ['py.typed'],
+        'pylti1p3.tool_config': ['py.typed'],
+        'pylti1p3.contrib': ['py.typed'],
+    },
 )