The Tink Python library, [tink-py](https://github.com/tink-crypto/tink-py),
supports Python 3.10 or newer on macOS (x86-64 and ARM64), Linux (x86-64 and
ARM64) and Windows (x86-64). The latest release is [1.16.1](https://github.com/tink-crypto/tink-py/releases/tag/v1.16.1). It can be installed locally using
[Pip](https://pypi.org/project/pip/) or used with [Bazel](http://bazel.build).

Tink Python provides integrations with [AWS KMS](https://aws.amazon.com/kms/),
[Google Cloud KMS](https://cloud.google.com/kms/) and [HashiCorp
Vault](https://www.vaultproject.io/).

## Pip

You can install the Tink Python binary release for your system from
[PyPI](https://pypi.org/project/tink/), by running the following command:

    pip3 install tink==1.16.1
    # Core Tink + Google Cloud KMS extension.
    pip3 install tink[gcpkms]==1.16.1
    # Core Tink + AWS KMS extension.
    pip3 install tink[awskms]==1.16.1
    # Core Tink + HashiCorp Vault KMS extension.
    pip3 install tink[hcvault]==1.16.1
    # Core Tink + all the KMS extensions.
    pip3 install tink[all]==1.16.1

If a binary package is not published for your environment, `pip` automatically
resorts to building the project using the source distribution published to PyPI.
If this is the case, you need [Bazel](http://bazel.build) or [Bazelisk](https://github.com/bazelbuild/bazelisk) and the
[protobuf compiler](https://github.com/protocolbuffers/protobuf#protocol-compiler-installation) installed to successfully build the
project.

## Bazel

[Bazel](http://bazel.build) users can use Tink Python either as a pip dependency
using [rules_python's `pip_parse`
macro](https://github.com/bazelbuild/rules_python/), or as a Bazel dependency in
their `MODULE.bazel`:

    bazel_dep(name = "tink_py")
    archive_override(
        module_name = "tink_py",
        urls = ["https://github.com/tink-crypto/tink-py/archive/refs/tags/v1.16.1.zip"],
        strip_prefix = "tink-py-1.16.1",
        sha256 = "01aa498e254e03fd08dcdcab87155830450e3e5476d25afa64e9680efdbdd06a",
    )

NOTE: We don't publish Tink Python in the Bazel Central Registry.

## Next steps

Once you've finished setting up Tink, continue with the standard Tink usage
steps:

- [Choose a primitive](https://developers.google.com/tink/choose-primitive) -- Decide which primitive to use based on your use case
- [Manage keys](https://developers.google.com/tink/key-management-overview) -- Protect your keys with your external KMS, generate keysets, and rotate your keys