nkeys

What it is and what it does

nkeys is a Python library that implements Ed25519-based public-key cryptography tailored for the NATS messaging ecosystem. It handles the generation, storage, and use of cryptographic key pairs for identity, authentication, and authorization of NATS entities like accounts, users, servers, and clusters. The library encodes raw 32- and 64-byte keys in a human-readable Base32 format with version prefixes (e.g., 'SU' for a user seed, 'U' for a user public key), making key material easier to work with than raw bytes.

The package wraps Ed25519 operations from pynacl and adds seed-based key derivation, signature generation and verification, and secure memory wiping. It is designed for scenarios where only the seed needs to be stored securely, since both public and private keys can be regenerated from it. The NATS system itself never stores private keys, instead using challenge-response authentication with the public key infrastructure that nkeys provides.

Use it for:

• Generate and manage Ed25519 key pairs for NATS server, cluster, account, and user authentication.
• Sign data with a private key and verify signatures in NATS-based distributed systems.
• Load cryptographic seeds from files and derive public/private key pairs for identity verification.
• Securely wipe key material from memory after use to prevent accidental exposure of secrets.
• Implement custom authentication flows in NATS clients that require Ed25519 signatures.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Generates, manages, and verifies Ed25519-based cryptographic key pairs for NATS ecosystem authentication and authorization, with human-readable key encoding.

Yes, if you are building or integrating with NATS systems that require Ed25519-based authentication. The package is actively maintained, has no known vulnerabilities, and supports modern Python versions. The main trade-off is high install friction due to pynacl's compilation requirement; verify that pre-built wheels are available for your platform before committing.

Install

nkeys on PyPI

pip install nkeys

uv add nkeys

poetry add nkeys

Installing nkeys

Before you install

High install friction due to pynacl dependency, which requires compilation. Package is actively maintained with recent commits and broad Python version support from 3.6 onward.

License in practice

Apache 2.0 permissive license allows commercial and private use with minimal restrictions; you must retain license notices in distributions.

Quickstart

import nkeys
import os

with open('user.nkey', 'rb', buffering=0) as f:
  seed = bytearray(os.fstat(f.fileno()).st_size)
  f.readinto(seed)
  user = nkeys.from_seed(seed)

data = b'arGTKH8q7XDmgy0'
sig = user.sign(data)
user.verify(data, sig)
user.wipe()

pynacl dependency requires a C compiler and libsodium development headers to build from source.

Verify before relying

• Whether pynacl is available as a pre-built wheel for your platform, which would avoid compilation.
• Performance characteristics when signing or verifying large volumes of data.

Package facts

Evidence: nkeys-0.2.1.tar.gz

Tags

More Cryptography packages