requests-aws4auth

requests-aws4auth is a Python library that adds Amazon Web Services signature version 4 (SigV4) authentication to the popular Requests HTTP library. By attaching an AWS4Auth object as the auth handler on a request, you can call any AWS service that supports v4 signing directly with plain HTTP requests, without pulling in a full AWS SDK.

The library implements header-based SigV4 signing, manages independent signing-key objects, and automatically regenerates keys when the signing scope’s date boundary is crossed. It also supports STS temporary credentials, making it a lightweight option for signing ad-hoc requests to services like S3, DynamoDB, ElasticSearch/OpenSearch, and dozens of others.

What You Get

• An AWS4Auth handler that plugs directly into the Requests library’s auth interface
• Header-based AWS signature version 4 signing for supported services
• Reusable, independent signing-key objects with automatic regeneration on scope-date rollover
• Support for STS temporary credentials (session tokens)
• Compatibility with a broad list of AWS services that support v4 auth

Common Use Cases

• Making signed requests to AWS services (S3, DynamoDB, OpenSearch) without a full SDK
• Querying Amazon OpenSearch/ElasticSearch endpoints that require SigV4 auth
• Signing ad-hoc or scripted HTTP calls to AWS APIs from lightweight tools

Under The Hood

Architecture - The library splits into two core modules: aws4auth.py defines AWS4Auth, a subclass of Requests’ AuthBase whose __call__ computes the canonical request, string-to-sign, and Authorization header for each outgoing request; aws4signingkey.py defines AWS4SigningKey, which derives the date/region/service-scoped signing key via the standard HMAC key-derivation chain and regenerates it when the scope date rolls over. exceptions.py holds the small error hierarchy.

Tech Stack - Pure Python (3.7+) packaged with setuptools via setup.py. Its only runtime dependency is requests; all cryptographic work uses hmac/hashlib from the standard library. STS session-token support is handled by including the security-token header in the signed set.

Code Quality - The package ships an in-tree test subpackage with unit tests exercising the signing logic against AWS’s published SigV4 test vectors, and a HISTORY.md changelog. It is a mature, heavily downloaded library; recent commit activity is low but the SigV4 algorithm it implements is a fixed specification, so stability is expected rather than concerning.

API Design - Usage is a one-liner: create AWS4Auth(access_id, secret_key, region, service, ...) and pass it as auth= to any requests call. The object is reusable across requests and can be built from a pre-derived AWS4SigningKey for efficiency. Because it conforms to the Requests auth interface, it drops into existing request code with no structural changes.