engiNIR-OPCUA

An OPC UA client and server for Python, built on asyncio and secure from the first line.

engiNIR-OPCUA implements OPC UA (IEC 62541, OPC 10000 v1.05) for Python 3.12 and newer: clients, servers, subscriptions, events, alarms and conditions, history, methods, file transfer, redundancy, certificate management and experimental PubSub, with a synchronous API and a command line program on top. Encrypted connections, certificate trust and user roles are switched on by default, and every one of them can be set up in a few lines. Every change is tested against the OPC Foundation's reference stack.

It is a fork of opcua-asyncio 2.1.0. The import package is enginir_opcua and the commands start with enginir-opcua, so it can be installed next to asyncua; the migration guide lists what changed.

Installation

uv add enginir-opcua

or pip install enginir-opcua. The command line program on its own:

uv tool install enginir-opcua

Quick start

A server and a client with a secure channel between them, in one process. Both create a PKI directory with a self-signed certificate. Nothing is trusted automatically, so each side copies the other's certificate into its trusted/certs folder (enginir-opcua pair does the same on the command line).

import asyncio
import shutil

from enginir_opcua import Client, Server


async def main() -> None:
    url = "opc.tcp://127.0.0.1:4840/enginir-opcua/server/"
    server = Server.quickstart(url, pki="server-pki")
    client = Client.quickstart(url, pki="client-pki")
    await server.init()
    await client.init_pki()
    shutil.copy("client-pki/own/certs/application.der", "server-pki/trusted/certs/client.der")
    shutil.copy("server-pki/own/certs/application.der", "client-pki/trusted/certs/server.der")

    idx = await server.register_namespace("urn:example:quickstart")
    temperature = await server.nodes.objects.add_variable(idx, "Temperature", 21.5)
    async with server, client:
        print(await client.get_node(temperature.nodeid).read_value())


asyncio.run(main())

The same with two programs, a users file and the command line is in A Minimal Server and A Minimal Client.

Secure by default

• Encrypted endpoints. The quick setup offers only SignAndEncrypt with Basic256Sha256, Aes128_Sha256_RsaOaep and Aes256_Sha256_RsaPss. An endpoint without security exists only when you ask for it. Client(url) without a security choice refuses to connect; Client(url, allow_no_security=True) is the explicit request.
• Profiles. secure is the default; development (this machine only, no security) and legacy (old devices, every policy) are your decision, and every weaker setting is logged at start. See Security Profiles.
• Explicit trust. Both sides check the peer's certificate at every secure channel, in the order of OPC 10000-4, and trust nobody until a certificate is put into the PKI directory.
• Users and roles. Anonymous sessions may read, browse and subscribe. Writing, calling methods and changing the address space need a user with the right role; passwords are stored as salted hashes.
• Hardened. The server is hardened against the attacks known for OPC UA servers, and certificates can be managed from the command line or remotely over OPC UA.
• Clear errors. A wrong setting raises a ConfigurationError that names it, and a refused certificate is reported with its thumbprint and the command that trusts it.

Command line

Set up the certificates of a server and a client, make them trust each other, start the server and browse it:

enginir-opcua init server srv --endpoint opc.tcp://127.0.0.1:4840/enginir-opcua/server/
enginir-opcua init client cli
enginir-opcua pair srv/pki cli/pki
enginir-opcua server --config srv/server.toml &
enginir-opcua ls -u opc.tcp://127.0.0.1:4840/enginir-opcua/server/ --pki-dir cli/pki -n i=85

enginir-opcua has the subcommands read, write, call, ls, subscribe, history, discover, server, shell and generate-structs, and init, trust, pki, pair and user to set up certificates and users. The client commands need --pki-dir or --security, and --security None asks for a connection without security. The demo server needs --config, --pki-dir or --no-security. See Installation & CLI Tools.

Documentation

The documentation is at https://enginir-opcua.readthedocs.io/en/latest/.

• Quick Setup: profiles, configuration files, users and roles, the trust commands
• OPC UA Basics: the terms the documentation uses
• Client, Server, Synchronous API and PubSub (experimental)
• Examples: 17 runnable programs in examples/, from a secure pair to alarms, history, file transfer and reverse connect
• Migrating from asyncua, and every change in CHANGELOG.md

Build the documentation locally with uv run --group docs sphinx-build -b html docs docs/_build/html.

Development

uv sync
git submodule update --init --depth 1 nodeset
uv run pytest -q -m "not slow"
uv run ruff check . && uv run ruff format --check . && uv run mypy enginir_opcua tests

The conventions for code and tests are in AGENTS.md and tests/README.md.

License

LGPL-3.0-or-later; see COPYING, COPYING.GPL and NOTICE. The original library was written by Olivier Roulet-Dubonnet and the opcua-asyncio contributors; this fork was made on 2026-10-25.