---
id: nkeys
version: "0.2.1"
license: Apache 2 License
license_treatment: permissive
maintenance: active
---

# nkeys — A public-key signature system based on Ed25519 for the NATS ecosystem.

License: permissive · Maintenance: active · Downloads: 513.5K/mo

## What it is and what it does

nkeys is a Python library that implements Ed25519-based public-key cryptography tailored for the NATS messaging ecosystem. It handles the generation, storage, and use of cryptographic key pairs for identity, authentication, and authorization of NATS entities like accounts, users, servers, and clusters. The library encodes raw 32- and 64-byte keys in a human-readable Base32 format with version prefixes (e.g., 'SU' for a user seed, 'U' for a user public key), making key material easier to work with than raw bytes.

The package wraps Ed25519 operations from pynacl and adds seed-based key derivation, signature generation and verification, and secure memory wiping. It is designed for scenarios where only the seed needs to be stored securely, since both public and private keys can be regenerated from it. The NATS system itself never stores private keys, instead using challenge-response authentication with the public key infrastructure that nkeys provides.

Use it for:

- Generate and manage Ed25519 key pairs for NATS server, cluster, account, and user authentication.
- Sign data with a private key and verify signatures in NATS-based distributed systems.
- Load cryptographic seeds from files and derive public/private key pairs for identity verification.
- Securely wipe key material from memory after use to prevent accidental exposure of secrets.
- Implement custom authentication flows in NATS clients that require Ed25519 signatures.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Generates, manages, and verifies Ed25519-based cryptographic key pairs for NATS ecosystem authentication and authorization, with human-readable key encoding.

Yes, if you are building or integrating with NATS systems that require Ed25519-based authentication. The package is actively maintained, has no known vulnerabilities, and supports modern Python versions. The main trade-off is high install friction due to pynacl's compilation requirement; verify that pre-built wheels are available for your platform before committing.

## Install

pip install nkeys
uv add nkeys
poetry add nkeys

## Installing nkeys

Before you install: High install friction due to pynacl dependency, which requires compilation. Package is actively maintained with recent commits and broad Python version support from 3.6 onward.

License in practice: Apache 2.0 permissive license allows commercial and private use with minimal restrictions; you must retain license notices in distributions.

Quickstart:

import nkeys
import os

with open('user.nkey', 'rb', buffering=0) as f:
  seed = bytearray(os.fstat(f.fileno()).st_size)
  f.readinto(seed)
  user = nkeys.from_seed(seed)

data = b'arGTKH8q7XDmgy0'
sig = user.sign(data)
user.verify(data, sig)
user.wipe()

pynacl dependency requires a C compiler and libsodium development headers to build from source.

Verify before relying:

- Whether pynacl is available as a pre-built wheel for your platform, which would avoid compilation.
- Performance characteristics when signing or verifying large volumes of data.

## Package facts

- License: Apache 2 License (permissive)
- Python support: supports_current
- Install friction: high
- Maintenance: active
- Downloads: 513.5K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

ed25519 key generation, nats authentication keys, public key signature system, cryptographic keypair management, nats ecosystem identity, ed25519 seed management, nkeys for nats, nats-ecosystem, ed25519, key-management

[View on SkillFed](https://skillfed.io/packages/nkeys) · [View on PyPI](https://pypi.org/project/nkeys/)