Auth: support passphrase-protected PEMs (currently forces plaintext key on disk) #217

Summary

KalshiAuth.from_pem calls serialization.load_pem_private_key(pem_data, password=None) and translates the resulting TypeError into an error that instructs users to run:

openssl pkey -in key.pem -out key_nopass.pem

The SDK has no API to supply a passphrase. Users whose RSA private key is encrypted at rest (a common, recommended practice for trading keys) are pushed to write a plaintext key to disk to use this SDK, materially worsening their security posture. This also blocks integration with secret managers that hand off encrypted PEMs.

Location

kalshi/auth.py:94-100

Evidence

# kalshi/auth.py:94-100
try:
    private_key = serialization.load_pem_private_key(pem_data, password=None)
except TypeError as e:
    raise KalshiAuthError(
        "Passphrase-protected private keys are not supported. "
        "Remove the passphrase with: openssl pkey -in key.pem -out key_nopass.pem"
    ) from e

Recommended fix

Add an optional password parameter to from_pem, from_key_path, from_env, and try_from_env:

@classmethod
def from_pem(
    cls,
    key_id: str,
    pem_data: str | bytes,
    *,
    password: bytes | str | Callable[[], bytes | str] | None = None,
) -> KalshiAuth:
    if isinstance(pem_data, str):
        pem_data = pem_data.encode("utf-8")
    pw: bytes | None = None
    if password is not None:
        raw = password() if callable(password) else password
        pw = raw.encode("utf-8") if isinstance(raw, str) else raw
    try:
        private_key = serialization.load_pem_private_key(pem_data, password=pw)
    except (TypeError, ValueError) as e:
        raise KalshiAuthError(...) from e
    ...

For env-driven flows, accept KALSHI_PRIVATE_KEY_PASSPHRASE (or a callback for interactive prompt). Document the new parameter in docs/authentication.md.

Tests:

• test_from_pem_with_passphrase_succeeds
• test_from_pem_with_wrong_passphrase_raises_KalshiAuthError
• test_from_env_picks_up_KALSHI_PRIVATE_KEY_PASSPHRASE

Severity & category

medium / security, dx