API Reference

Package

HTTP Negotiate authentication for httpx2 using Windows SSPI.

The public API is centered on httpx2_negotiate_sspi.HttpNegotiateAuth, an httpx2.Auth implementation for Windows clients that need Kerberos or NTLM negotiation against HTTP services.

Core auth implementation

Windows SSPI-backed HTTP Negotiate authentication for httpx2.

This module exposes HttpNegotiateAuth, a small httpx2.Auth implementation that drives the SSPI challenge-response handshake for Negotiate and NTLM HTTP authentication.

The implementation is intentionally Windows-specific because it depends on the SSPI interfaces provided by pywin32. When the transport exposes an SSL object in the response extensions, the auth flow includes a TLS channel binding token derived from the peer certificate so it can interoperate with servers that require Extended Protection for Authentication.

class httpx2_negotiate_sspi.HttpNegotiateAuth(username=None, password=None, domain=None, service=None, host=None, delegate=False)

Create a new Negotiate auth handler.

Parameters:

• username (str | None) – Username.

• password (str | None) – Password.

• domain (str | None) – NT domain name. Defaults to '.' for a local account.

• service (str | None) – Kerberos service type for the remote SPN. Defaults to 'HTTP'.

• host (str | None) – Host name for the SPN. When omitted, each challenged request computes its own SPN host from the request URI and may canonicalize it through DNS.

• delegate (bool) – Whether the user’s credentials may be delegated to the server. Enable this only when the remote service is trusted to act on the caller’s behalf.

Explicit credentials are used only when both username and password are provided. Otherwise the current Windows logon credentials are used, which allows single sign-on to domain resources for interactive users and service accounts.

auth_flow(request)

Run the shared Negotiate/NTLM authentication state machine.

httpx2 drives this generator by sending each yielded request and passing the resulting response back in. Use sync_auth_flow and async_auth_flow through httpx2.Client or httpx2.AsyncClient; this method exists as the shared implementation for both client modes.

Parameters:

request (Request) – Initial request created by the caller.

Yields:

The original request, followed by any retry requests needed to complete the HTTP authentication exchange.

Raises:

httpx2.HTTPError – If the server returns an invalid NTLM challenge sequence.

Return type:

Generator[Request, Response, None]

The flow adds Connection: Keep-Alive to the outgoing request, stops immediately when the response is not 401, and tries Negotiate before NTLM when both are advertised.

sync_auth_flow(request)

Authenticate a request for httpx2.Client.

Request and response bodies are read before the SSPI handshake advances so retry requests can be sent safely through httpx2’s auth flow.

Parameters:

request (Request) – Request created by httpx2.Client.

Yields:

Requests that should be sent synchronously.

Return type:

Generator[Request, Response, None]

Reading the bodies eagerly ensures that replayed requests do not depend on unread streams that may no longer be available when the server challenges the original request.

async async_auth_flow(request)

Authenticate a request for httpx2.AsyncClient.

The Windows SSPI calls are synchronous, but this async generator follows httpx2’s async auth contract and awaits request and response body reads before advancing the shared handshake.

Parameters:

request (Request) – Request created by httpx2.AsyncClient.

Yields:

Requests that should be sent asynchronously.

Return type:

AsyncGenerator[Request, Response]

Just like sync_auth_flow, this eagerly reads request and response bodies so the authentication retry sequence can safely resend the request after a 401 challenge.

Version

httpx2_negotiate_sspi.__version__: str

Package version. pyproject.toml reads this value from httpx2_negotiate_sspi.__version__.__version__ when building the distribution.