Tink setup
Stay organized with collections
Save and categorize content based on your preferences.
You can build Tink from source or use language-specific packages. The following
instructions get you started.
After you've finished installing and setting up Tink, continue with the Next
Steps at the end of this page.
Python
The Tink Python library, tink-py,
supports Python 3.9 or newer on macOS (x86-64 and ARM64), Linux (x86-64 and
ARM64) and Windows (x86-64). The latest release is
1.12.0. It can be installed locally using
Pip or used with
Bazel.
Tink Python provides integrations with AWS
KMS, Google Cloud
KMS and HashiCorp
Vault.
Pip
You can install the Tink Python binary release for your system from
PyPI, by running the following command:
pip3 install tink==1.12.0
# Core Tink + Google Cloud KMS extension.
pip3 install tink[gcpkms]==1.12.0
# Core Tink + AWS KMS extension.
pip3 install tink[awskms]==1.12.0
# Core Tink + HashiCorp Vault KMS extension.
pip3 install tink[hcvault]==1.12.0
# Core Tink + all the KMS extensions.
pip3 install tink[all]==1.12.0
If a binary package is not published for your environment, pip
automatically resorts to building the project using the source distribution
published to PyPI. If this is the case, you need Bazel
or Bazelisk and the protobuf
compiler installed to successfully build the project.
Bazel
For Tink Python 1.12 and later, Bazel users need to
use MODULE.bazel:
bazel_dep(name = "tink_py")
archive_override(
module_name = "tink_py",
urls = ["https://github.com/tink-crypto/tink-py/releases/download/v1.12.0/tink-py-1.12.0.zip"],
strip_prefix = "tink-py-1.12.0",
sha256 = "5968d0ba84f1fc958f685cfdfc667bfb1d8414a22eaa6f502b290a23af2aba43",
)
We don't publish Tink Python in the Bazel Central Registry at the moment.
Next steps
Once you've finished setting up Tink, continue with the standard Tink usage
steps:
- Choose a primitive – Decide which primitive to use
based on your use case
- Manage keys – Protect your keys with your
external KMS, generate keysets, and rotate your keys
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2025-06-05 UTC.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-06-05 UTC."],[[["\u003cp\u003eTink can be built from source or installed using language-specific packages for C++, Go, Java, Objective-C, and Python.\u003c/p\u003e\n"],["\u003cp\u003eTink offers core libraries and extensions for cloud key management systems like AWS KMS and Google Cloud KMS.\u003c/p\u003e\n"],["\u003cp\u003eAfter installation, users should choose a cryptographic primitive and establish a key management strategy.\u003c/p\u003e\n"],["\u003cp\u003eLanguage-specific instructions and dependencies are detailed for building and using Tink in each supported language.\u003c/p\u003e\n"],["\u003cp\u003eTink supports various operating systems, compilers, and build systems for each language, ensuring flexibility for developers.\u003c/p\u003e\n"]]],["Tink can be set up via source or language-specific packages. For C++, use Bazel or CMake, ensuring dependencies like Protobuf and Abseil are met. Go uses `go get` for core and extension libraries like AWS KMS, Google Cloud KMS, and HashiCorp Vault. Python employs `pip3 install` or Bazel for installation, supporting extensions. After setting up Tink, users should choose a primitive and manage keys.\n"],null,["You can build Tink from source or use language-specific packages. The following\ninstructions get you started.\n\nAfter you've finished installing and setting up Tink, continue with the [Next\nSteps](#next_steps) at the end of this page. \n\nC++\n\n[Set up Tink C++ and extensions](/tink/setup/cc)\n\nGo\n\n[Set up Tink Go and extensions](/tink/setup/go)\n\nJava\n\n[Set up Tink Java and extensions](/tink/setup/java)\n\nObjC**Note:** These instructions are for the newest release, [Tink\n| 1.7.0](https://github.com/google/tink/releases/).\n\nSee the [HOWTO on GitHub](https://github.com/google/tink/blob/v1.7.0/docs/OBJC-HOWTO.md)\n\nPython\n\n\nThe Tink Python library, [tink-py](https://github.com/tink-crypto/tink-py),\nsupports Python 3.9 or newer on macOS (x86-64 and ARM64), Linux (x86-64 and\nARM64) and Windows (x86-64). The latest release is [1.12.0](https://github.com/tink-crypto/tink-py/releases/tag/v1.12.0). It can be installed locally using\n[Pip](https://pypi.org/project/pip/) or used with\n[Bazel](http://bazel.build).\n\nTink Python provides integrations with [AWS\nKMS](https://aws.amazon.com/kms/), [Google Cloud\nKMS](https://cloud.google.com/kms/) and [HashiCorp\nVault](https://www.vaultproject.io/).\n\nPip\n\nYou can install the Tink Python binary release for your system from\n[PyPI](https://pypi.org/project/tink/), by running the following command: \n\n pip3 install tink==1.12.0\n # Core Tink + Google Cloud KMS extension.\n pip3 install tink[gcpkms]==1.12.0\n # Core Tink + AWS KMS extension.\n pip3 install tink[awskms]==1.12.0\n # Core Tink + HashiCorp Vault KMS extension.\n pip3 install tink[hcvault]==1.12.0\n # Core Tink + all the KMS extensions.\n pip3 install tink[all]==1.12.0\n\nIf a binary package is not published for your environment, `pip`\nautomatically resorts to building the project using the source distribution\npublished to PyPI. If this is the case, you need [Bazel](http://bazel.build)\nor [Bazelisk](https://github.com/bazelbuild/bazelisk) and the [protobuf\ncompiler](https://github.com/protocolbuffers/protobuf#protocol-compiler-installation) installed to successfully build the project.\n\nBazel\n\nFor Tink Python 1.12 and later, [Bazel](http://bazel.build) users need to\nuse `MODULE.bazel`: \n\n bazel_dep(name = \"tink_py\")\n\n archive_override(\n module_name = \"tink_py\",\n urls = [\"https://github.com/tink-crypto/tink-py/releases/download/v1.12.0/tink-py-1.12.0.zip\"],\n strip_prefix = \"tink-py-1.12.0\",\n sha256 = \"5968d0ba84f1fc958f685cfdfc667bfb1d8414a22eaa6f502b290a23af2aba43\",\n )\n\nWe don't publish Tink Python in the Bazel Central Registry at the moment.\n\nNext steps\n\nOnce you've finished setting up Tink, continue with the standard Tink usage\nsteps:\n\n- [Choose a primitive](/tink/choose-primitive) -- Decide which primitive to use based on your use case\n- [Manage keys](/tink/key-management-overview) -- Protect your keys with your external KMS, generate keysets, and rotate your keys"]]
