Skip to main content

An AWS IAM authentication package for Requests. Supported services: API Gateway v1

Project description

Requests AWS IAM Auth

An AWS IAM authentication package for Requests. Supported services: API Gateway v1. This is intended for use in production environments at the 1.0 release.


API Gateway v1

import requests
import requests_aws_iam_auth

# Provide AWS creds and config per Boto3 specs:
auth = requests_aws_iam_auth.ApiGateway()

requests.get("", auth=auth)

Developer Information




authorization, and x-amz-content-sha256 are directly modified in the signing protocal and will be set.

Expect for authorization, connection, expect, user-agent, x-amz-content-sha256, x-amz-security-token and x-amzn-trace-id all user set headers are signed.

If the user does not specify host it is derived and signed.

If the method is not GET, HEAD, or OPTIONS, has a payload, and the user does not provide a content-length header it is derived and signed.

If there's a Date header, we set the date header. Otherwise, we set the X-Amz-Date header.

The underlying http.client will derive an unsigned accept-encoding header if not user specified.

If using STS x-amz-security-token will be set by this library.


The payload is always signed using SHA 256.


HTTP and HTTPS 1.1 are supported.


Latest three minor versions of python will be supported.

Contributor Notes

This library uses botocore for signing.

Requests uses urllib3 which uses http.client.

Botocore relies on http.client deriving the host when absent. Botocore replacates this deravation and signs with it but does not append the header to the sent request. This has the potential for a mismatch error. There is a TODO in botocore to set the host header in the request.



Mateus Amin and Benton Drew

API Gateway v1

Mateus Amin and Benton Drew

Some Other Service




  • Add testing of three most recent python versions. Use docker not tox. No reason to bloat the stack.
  • Add fuzzing?
  • Add CI build. Keep it portable and deterministic.
  • Support AWS API Gateway v2 if it adds IAM Auth as a feature. Same for HTTP2.
  • Add Requests v3 support.
  • connection header. The connection header is set to blank between post auth and the server signing (inclusive). Could be a AWS, Requests, urllib3, botocore, or http.client. Have ruled out botocore. Can rule out the urllib3 and http.client by reading the sent request on the wire. As a temporary workaround we do not sign it.

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

requests_aws_iam_auth-0.2.0.tar.gz (3.4 kB view hashes)

Uploaded source

Built Distribution

Supported by

AWS AWS Cloud computing Datadog Datadog Monitoring Facebook / Instagram Facebook / Instagram PSF Sponsor Fastly Fastly CDN Google Google Object Storage and Download Analytics Huawei Huawei PSF Sponsor Microsoft Microsoft PSF Sponsor NVIDIA NVIDIA PSF Sponsor Pingdom Pingdom Monitoring Salesforce Salesforce PSF Sponsor Sentry Sentry Error logging StatusPage StatusPage Status page