---
id: aws-msk-iam-sasl-signer-python
version: "1.0.2"
license: Apache Software License 2.0
license_treatment: permissive
maintenance: aging
---

# aws-msk-iam-sasl-signer-python — Amazon MSK Library in Python for SASL/OAUTHBEARER Auth

License: permissive · Maintenance: aging · Downloads: 5.4M/mo

## What it is and what it does

This package provides a Python library to generate base64-encoded signed authentication tokens for Amazon MSK clusters using IAM credentials. It implements the SASL/OAUTHBEARER mechanism and can source credentials from the AWS default chain, named profiles, assumed roles, or custom credential providers. The library depends on boto3 and botocore for AWS credential handling and Click for CLI support.

You integrate it by creating a token callback that calls one of the token generation methods and passing that callback to your Kafka client's OAUTHBEARER configuration. The library handles IAM signing and token expiry tracking, returning both the token and its expiration time in milliseconds.

Use it for:

- Authenticate Kafka producers and consumers to MSK clusters using IAM roles instead of static credentials.
- Integrate MSK authentication into applications running on EC2 instances with instance profiles or ECS tasks with task roles.
- Use assumed IAM roles to generate temporary tokens for cross-account MSK access.
- Implement token refresh logic in long-running Kafka applications by extracting expiry time from returned values.
- Debug credential chain issues by enabling aws_debug_creds to log which IAM principal is being used.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Generates IAM-signed SASL/OAUTHBEARER authentication tokens for Amazon MSK clusters using AWS credentials from the default chain, named profiles, assumed roles, or custom providers.

Yes, if you use Amazon MSK and need IAM-based authentication. The package is Production/Stable, supports Python 3.8 through 3.13, has no known vulnerabilities, and is maintained by AWS. Install friction is low. Maintenance is aging (527 days since last release), so verify compatibility with your Kafka client library version before committing.

## Install

pip install aws-msk-iam-sasl-signer-python
uv add aws-msk-iam-sasl-signer-python
poetry add aws-msk-iam-sasl-signer-python

## Installing aws-msk-iam-sasl-signer-python

Before you install: Low install friction; pure Python wheel with three runtime dependencies (Click, boto3, botocore). Last release 527 days ago; repository not archived but maintenance is aging.

License in practice: Apache Software License 2.0 is permissive; you may use, modify, and distribute freely in commercial and private projects with minimal restrictions.

Quickstart:

pip install aws-msk-iam-sasl-signer-python

from aws_msk_iam_sasl_signer import MSKAuthTokenProvider

auth_token, expiry_ms = MSKAuthTokenProvider.generate_auth_token('')

Requires AWS credentials configured in your environment (via default chain, named profile, assumed role, or custom credential provider); MSK cluster must support SASL/OAUTHBEARER mechanism.

Verify before relying:

- Whether the package works with all Kafka client libraries supporting SASL/OAUTHBEARER or only specific ones.
- Performance characteristics when generating tokens at scale or under high frequency.
- Compatibility with non-standard AWS credential sources beyond those documented.

## Package facts

- License: Apache Software License 2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: aging
- Downloads: 5.4M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

MSK Kafka IAM authentication, AWS MSK SASL OAUTHBEARER, Kafka IAM token generator, MSK SASL signer, AWS Kafka authentication, MSK IAM credentials, OAUTHBEARER token provider, aws-msk, kafka-auth, iam-credentials

[View on SkillFed](https://skillfed.io/packages/aws-msk-iam-sasl-signer-python) · [View on PyPI](https://pypi.org/project/aws-msk-iam-sasl-signer-python/)