Set up Tink Python

The Tink Python library, tink-py, supports Python 3.9 or newer on macOS (x86-64 and ARM64), Linux (x86-64 and ARM64) and Windows (x86-64). The latest release is 1.13.0. It can be installed locally using Pip or used with Bazel.

Tink Python provides integrations with AWS KMS, Google Cloud KMS and HashiCorp Vault.

Pip

You can install the Tink Python binary release for your system from PyPI, by running the following command:

pip3 install tink==1.13.0
# Core Tink + Google Cloud KMS extension.
pip3 install tink[gcpkms]==1.13.0
# Core Tink + AWS KMS extension.
pip3 install tink[awskms]==1.13.0
# Core Tink + HashiCorp Vault KMS extension.
pip3 install tink[hcvault]==1.13.0
# Core Tink + all the KMS extensions.
pip3 install tink[all]==1.13.0

If a binary package is not published for your environment, pip automatically resorts to building the project using the source distribution published to PyPI. If this is the case, you need Bazel or Bazelisk and the protobuf compiler installed to successfully build the project.

Bazel

Bazel users can use Tink Python either as a pip dependency using rules_python's pip_parse macro, or as a Bazel dependency in their MODULE.bazel:

bazel_dep(name = "tink_py")
archive_override(
    module_name = "tink_py",
    urls = ["https://github.com/tink-crypto/tink-py/releases/download/v1.13.0/tink-py-1.13.0.zip"],
    strip_prefix = "tink-py-1.13.0",
    sha256 = "874a9837022d6124e3d28785cf40f0a9495637ab5e91fda5392412b200f0cced",
)

NOTE: We don't publish Tink Python in the Bazel Central Registry.

Next steps

Once you've finished setting up Tink, continue with the standard Tink usage steps:

  • Choose a primitive – Decide which primitive to use based on your use case
  • Manage keys – Protect your keys with your external KMS, generate keysets, and rotate your keys