diff --git a/google/auth/_cloud_sdk.py b/google/auth/_cloud_sdk.py
index 36c5b0158..a94411949 100644
--- a/google/auth/_cloud_sdk.py
+++ b/google/auth/_cloud_sdk.py
@@ -17,8 +17,6 @@
 import os
 import subprocess
 
-import six
-
 from google.auth import _helpers
 from google.auth import environment_vars
 from google.auth import exceptions
@@ -152,4 +150,4 @@ def get_auth_access_token(account=None):
         new_exc = exceptions.UserAccessTokenError(
             "Failed to obtain access token", caught_exc
         )
-        six.raise_from(new_exc, caught_exc)
+        raise new_exc from caught_exc
diff --git a/google/auth/_credentials_async.py b/google/auth/_credentials_async.py
index d4d4e2c0e..760758d85 100644
--- a/google/auth/_credentials_async.py
+++ b/google/auth/_credentials_async.py
@@ -18,13 +18,10 @@
 import abc
 import inspect
 
-import six
-
 from google.auth import credentials
 
 
-@six.add_metaclass(abc.ABCMeta)
-class Credentials(credentials.Credentials):
+class Credentials(credentials.Credentials, metaclass=abc.ABCMeta):
     """Async inherited credentials class from google.auth.credentials.
     The added functionality is the before_request call which requires
     async/await syntax.
@@ -84,8 +81,7 @@ class AnonymousCredentials(credentials.AnonymousCredentials, Credentials):
     """
 
 
-@six.add_metaclass(abc.ABCMeta)
-class ReadOnlyScoped(credentials.ReadOnlyScoped):
+class ReadOnlyScoped(credentials.ReadOnlyScoped, metaclass=abc.ABCMeta):
     """Interface for credentials whose scopes can be queried.
 
     OAuth 2.0-based credentials allow limiting access using scopes as described
@@ -171,6 +167,5 @@ def with_scopes_if_required(credentials, scopes):
         return credentials
 
 
-@six.add_metaclass(abc.ABCMeta)
-class Signing(credentials.Signing):
+class Signing(credentials.Signing, metaclass=abc.ABCMeta):
     """Interface for credentials that can cryptographically sign messages."""
diff --git a/google/auth/_default.py b/google/auth/_default.py
index 1ae26b4eb..f77fa1808 100644
--- a/google/auth/_default.py
+++ b/google/auth/_default.py
@@ -23,8 +23,6 @@
 import os
 import warnings
 
-import six
-
 from google.auth import environment_vars
 from google.auth import exceptions
 import google.auth.transport._http_client
@@ -124,7 +122,7 @@ def load_credentials_from_file(
             new_exc = exceptions.DefaultCredentialsError(
                 "File {} is not a valid json file.".format(filename), caught_exc
             )
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
     return _load_credentials_from_info(
         filename, info, scopes, default_scopes, quota_project_id, request
     )
@@ -440,7 +438,7 @@ def _get_authorized_user_credentials(filename, info, scopes=None):
     except ValueError as caught_exc:
         msg = "Failed to load authorized user credentials from {}".format(filename)
         new_exc = exceptions.DefaultCredentialsError(msg, caught_exc)
-        six.raise_from(new_exc, caught_exc)
+        raise new_exc from caught_exc
     return credentials, None
 
 
@@ -454,7 +452,7 @@ def _get_service_account_credentials(filename, info, scopes=None, default_scopes
     except ValueError as caught_exc:
         msg = "Failed to load service account credentials from {}".format(filename)
         new_exc = exceptions.DefaultCredentialsError(msg, caught_exc)
-        six.raise_from(new_exc, caught_exc)
+        raise new_exc from caught_exc
     return credentials, info.get("project_id")
 
 
@@ -500,7 +498,7 @@ def _get_impersonated_service_account_credentials(filename, info, scopes):
             filename
         )
         new_exc = exceptions.DefaultCredentialsError(msg, caught_exc)
-        six.raise_from(new_exc, caught_exc)
+        raise new_exc from caught_exc
     return credentials, None
 
 
@@ -514,7 +512,7 @@ def _get_gdch_service_account_credentials(filename, info):
     except ValueError as caught_exc:
         msg = "Failed to load GDCH service account credentials from {}".format(filename)
         new_exc = exceptions.DefaultCredentialsError(msg, caught_exc)
-        six.raise_from(new_exc, caught_exc)
+        raise new_exc from caught_exc
     return credentials, info.get("project")
 
 
diff --git a/google/auth/_default_async.py b/google/auth/_default_async.py
index 93a570c77..2e53e2088 100644
--- a/google/auth/_default_async.py
+++ b/google/auth/_default_async.py
@@ -21,8 +21,6 @@
 import json
 import os
 
-import six
-
 from google.auth import _default
 from google.auth import environment_vars
 from google.auth import exceptions
@@ -63,7 +61,7 @@ def load_credentials_from_file(filename, scopes=None, quota_project_id=None):
             new_exc = exceptions.DefaultCredentialsError(
                 "File {} is not a valid json file.".format(filename), caught_exc
             )
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
 
     # The type key should indicate that the file is either a service account
     # credentials file or an authorized user credentials file.
@@ -79,7 +77,7 @@ def load_credentials_from_file(filename, scopes=None, quota_project_id=None):
         except ValueError as caught_exc:
             msg = "Failed to load authorized user credentials from {}".format(filename)
             new_exc = exceptions.DefaultCredentialsError(msg, caught_exc)
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
         if quota_project_id:
             credentials = credentials.with_quota_project(quota_project_id)
         if not credentials.quota_project_id:
@@ -96,7 +94,7 @@ def load_credentials_from_file(filename, scopes=None, quota_project_id=None):
         except ValueError as caught_exc:
             msg = "Failed to load service account credentials from {}".format(filename)
             new_exc = exceptions.DefaultCredentialsError(msg, caught_exc)
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
         return credentials, info.get("project_id")
 
     else:
diff --git a/google/auth/_exponential_backoff.py b/google/auth/_exponential_backoff.py
index b5801bec9..0dd621a94 100644
--- a/google/auth/_exponential_backoff.py
+++ b/google/auth/_exponential_backoff.py
@@ -15,8 +15,6 @@
 import random
 import time
 
-import six
-
 # The default amount of retry attempts
 _DEFAULT_RETRY_TOTAL_ATTEMPTS = 3
 
@@ -38,7 +36,7 @@
 """
 
 
-class ExponentialBackoff(six.Iterator):
+class ExponentialBackoff:
     """An exponential backoff iterator. This can be used in a for loop to
     perform requests with exponential backoff.
 
diff --git a/google/auth/_helpers.py b/google/auth/_helpers.py
index 30fbafb64..ad2c095f2 100644
--- a/google/auth/_helpers.py
+++ b/google/auth/_helpers.py
@@ -18,9 +18,7 @@
 import calendar
 import datetime
 import sys
-
-import six
-from six.moves import urllib
+import urllib
 
 from google.auth import exceptions
 
@@ -89,9 +87,6 @@ def datetime_to_secs(value):
 def to_bytes(value, encoding="utf-8"):
     """Converts a string value to bytes, if necessary.
 
-    Unfortunately, ``six.b`` is insufficient for this task since in
-    Python 2 because it does not modify ``unicode`` objects.
-
     Args:
         value (Union[str, bytes]): The value to be converted.
         encoding (str): The encoding to use to convert unicode to bytes.
@@ -104,8 +99,8 @@ def to_bytes(value, encoding="utf-8"):
     Raises:
         google.auth.exceptions.InvalidValue: If the value could not be converted to bytes.
     """
-    result = value.encode(encoding) if isinstance(value, six.text_type) else value
-    if isinstance(result, six.binary_type):
+    result = value.encode(encoding) if isinstance(value, str) else value
+    if isinstance(result, bytes):
         return result
     else:
         raise exceptions.InvalidValue(
@@ -126,8 +121,8 @@ def from_bytes(value):
     Raises:
         google.auth.exceptions.InvalidValue: If the value could not be converted to unicode.
     """
-    result = value.decode("utf-8") if isinstance(value, six.binary_type) else value
-    if isinstance(result, six.text_type):
+    result = value.decode("utf-8") if isinstance(value, bytes) else value
+    if isinstance(result, str):
         return result
     else:
         raise exceptions.InvalidValue(
@@ -171,7 +166,7 @@ def update_query(url, params, remove=None):
     query_params.update(params)
     # Remove any values specified in remove.
     query_params = {
-        key: value for key, value in six.iteritems(query_params) if key not in remove
+        key: value for key, value in query_params.items() if key not in remove
     }
     # Re-encoded the query string.
     new_query = urllib.parse.urlencode(query_params, doseq=True)
diff --git a/google/auth/_oauth2client.py b/google/auth/_oauth2client.py
index a86ba8dd6..8b83ff23c 100644
--- a/google/auth/_oauth2client.py
+++ b/google/auth/_oauth2client.py
@@ -21,8 +21,6 @@
 
 from __future__ import absolute_import
 
-import six
-
 from google.auth import _helpers
 import google.auth.app_engine
 import google.auth.compute_engine
@@ -34,7 +32,7 @@
     import oauth2client.contrib.gce  # type: ignore
     import oauth2client.service_account  # type: ignore
 except ImportError as caught_exc:
-    six.raise_from(ImportError("oauth2client is not installed."), caught_exc)
+    raise ImportError("oauth2client is not installed.") from caught_exc
 
 try:
     import oauth2client.contrib.appengine  # type: ignore
@@ -166,4 +164,4 @@ def convert(credentials):
         return _CLASS_CONVERSION_MAP[credentials_class](credentials)
     except KeyError as caught_exc:
         new_exc = ValueError(_CONVERT_ERROR_TMPL.format(credentials_class))
-        six.raise_from(new_exc, caught_exc)
+        raise new_exc from caught_exc
diff --git a/google/auth/_service_account_info.py b/google/auth/_service_account_info.py
index b17f34f5c..6b64adcae 100644
--- a/google/auth/_service_account_info.py
+++ b/google/auth/_service_account_info.py
@@ -17,8 +17,6 @@
 import io
 import json
 
-import six
-
 from google.auth import crypt
 from google.auth import exceptions
 
@@ -46,7 +44,7 @@ def from_dict(data, require=None, use_rsa_signer=True):
     """
     keys_needed = set(require if require is not None else [])
 
-    missing = keys_needed.difference(six.iterkeys(data))
+    missing = keys_needed.difference(data.keys())
 
     if missing:
         raise exceptions.MalformedError(
diff --git a/google/auth/aws.py b/google/auth/aws.py
index 072c67bad..6e0e4e864 100644
--- a/google/auth/aws.py
+++ b/google/auth/aws.py
@@ -39,14 +39,13 @@
 
 import hashlib
 import hmac
+import http.client as http_client
 import json
 import os
 import posixpath
 import re
-
-from six.moves import http_client
-from six.moves import urllib
-from six.moves.urllib.parse import urljoin
+import urllib
+from urllib.parse import urljoin
 
 from google.auth import _helpers
 from google.auth import environment_vars
diff --git a/google/auth/compute_engine/_metadata.py b/google/auth/compute_engine/_metadata.py
index c5b9d5a2b..04abe178f 100644
--- a/google/auth/compute_engine/_metadata.py
+++ b/google/auth/compute_engine/_metadata.py
@@ -18,13 +18,11 @@
 """
 
 import datetime
+import http.client as http_client
 import json
 import logging
 import os
-
-import six
-from six.moves import http_client
-from six.moves.urllib import parse as urlparse
+from urllib.parse import urljoin
 
 from google.auth import _helpers
 from google.auth import environment_vars
@@ -185,7 +183,7 @@ def get(
         google.auth.exceptions.TransportError: if an error occurred while
             retrieving metadata.
     """
-    base_url = urlparse.urljoin(root, path)
+    base_url = urljoin(root, path)
     query_params = {} if params is None else params
 
     headers_to_use = _METADATA_HEADERS.copy()
@@ -228,7 +226,7 @@ def get(
                     "Received invalid JSON from the Google Compute Engine "
                     "metadata service: {:.20}".format(content)
                 )
-                six.raise_from(new_exc, caught_exc)
+                raise new_exc from caught_exc
         else:
             return content
     else:
diff --git a/google/auth/compute_engine/credentials.py b/google/auth/compute_engine/credentials.py
index 930d88617..7ae673880 100644
--- a/google/auth/compute_engine/credentials.py
+++ b/google/auth/compute_engine/credentials.py
@@ -21,8 +21,6 @@
 
 import datetime
 
-import six
-
 from google.auth import _helpers
 from google.auth import credentials
 from google.auth import exceptions
@@ -118,7 +116,7 @@ def refresh(self, request):
             )
         except exceptions.TransportError as caught_exc:
             new_exc = exceptions.RefreshError(caught_exc)
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
 
     @property
     def service_account_email(self):
@@ -386,7 +384,7 @@ def _call_metadata_identity_endpoint(self, request):
             )
         except exceptions.TransportError as caught_exc:
             new_exc = exceptions.RefreshError(caught_exc)
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
 
         _, payload, _, _ = jwt._unverified_decode(id_token)
         return id_token, datetime.datetime.utcfromtimestamp(payload["exp"])
diff --git a/google/auth/credentials.py b/google/auth/credentials.py
index c27721dbb..3ae9c4011 100644
--- a/google/auth/credentials.py
+++ b/google/auth/credentials.py
@@ -18,15 +18,12 @@
 import abc
 import os
 
-import six
-
 from google.auth import _helpers, environment_vars
 from google.auth import exceptions
 from google.auth import metrics
 
 
-@six.add_metaclass(abc.ABCMeta)
-class Credentials(object):
+class Credentials(metaclass=abc.ABCMeta):
     """Base class for all credentials.
 
     All credentials have a :attr:`token` that is used for authentication and
@@ -232,8 +229,7 @@ def before_request(self, request, method, url, headers):
         """Anonymous credentials do nothing to the request."""
 
 
-@six.add_metaclass(abc.ABCMeta)
-class ReadOnlyScoped(object):
+class ReadOnlyScoped(metaclass=abc.ABCMeta):
     """Interface for credentials whose scopes can be queried.
 
     OAuth 2.0-based credentials allow limiting access using scopes as described
@@ -374,8 +370,7 @@ def with_scopes_if_required(credentials, scopes, default_scopes=None):
         return credentials
 
 
-@six.add_metaclass(abc.ABCMeta)
-class Signing(object):
+class Signing(metaclass=abc.ABCMeta):
     """Interface for credentials that can cryptographically sign messages."""
 
     @abc.abstractmethod
diff --git a/google/auth/crypt/__init__.py b/google/auth/crypt/__init__.py
index 9f91f0d0b..6d147e706 100644
--- a/google/auth/crypt/__init__.py
+++ b/google/auth/crypt/__init__.py
@@ -37,8 +37,6 @@
 version is at least 1.4.0.
 """
 
-import six
-
 from google.auth.crypt import base
 from google.auth.crypt import rsa
 
@@ -90,7 +88,7 @@ class to use for verification. This can be used to select different
     Returns:
         bool: True if the signature is valid, otherwise False.
     """
-    if isinstance(certs, (six.text_type, six.binary_type)):
+    if isinstance(certs, (str, bytes)):
         certs = [certs]
 
     for cert in certs:
diff --git a/google/auth/crypt/_python_rsa.py b/google/auth/crypt/_python_rsa.py
index e8595440c..e553c25ed 100644
--- a/google/auth/crypt/_python_rsa.py
+++ b/google/auth/crypt/_python_rsa.py
@@ -21,12 +21,13 @@
 
 from __future__ import absolute_import
 
+import io
+
 from pyasn1.codec.der import decoder  # type: ignore
 from pyasn1_modules import pem  # type: ignore
 from pyasn1_modules.rfc2459 import Certificate  # type: ignore
 from pyasn1_modules.rfc5208 import PrivateKeyInfo  # type: ignore
 import rsa  # type: ignore
-import six
 
 from google.auth import _helpers
 from google.auth import exceptions
@@ -53,9 +54,9 @@ def _bit_list_to_bytes(bit_list):
     """
     num_bits = len(bit_list)
     byte_vals = bytearray()
-    for start in six.moves.xrange(0, num_bits, 8):
+    for start in range(0, num_bits, 8):
         curr_bits = bit_list[start : start + 8]
-        char_val = sum(val * digit for val, digit in six.moves.zip(_POW2, curr_bits))
+        char_val = sum(val * digit for val, digit in zip(_POW2, curr_bits))
         byte_vals.append(char_val)
     return bytes(byte_vals)
 
@@ -153,7 +154,7 @@ def from_string(cls, key, key_id=None):
         """
         key = _helpers.from_bytes(key)  # PEM expects str in Python 3
         marker_id, key_bytes = pem.readPemBlocksFromFile(
-            six.StringIO(key), _PKCS1_MARKER, _PKCS8_MARKER
+            io.StringIO(key), _PKCS1_MARKER, _PKCS8_MARKER
         )
 
         # Key is in pkcs1 format.
diff --git a/google/auth/crypt/base.py b/google/auth/crypt/base.py
index 573211d7c..ad871c311 100644
--- a/google/auth/crypt/base.py
+++ b/google/auth/crypt/base.py
@@ -18,16 +18,13 @@
 import io
 import json
 
-import six
-
 from google.auth import exceptions
 
 _JSON_FILE_PRIVATE_KEY = "private_key"
 _JSON_FILE_PRIVATE_KEY_ID = "private_key_id"
 
 
-@six.add_metaclass(abc.ABCMeta)
-class Verifier(object):
+class Verifier(metaclass=abc.ABCMeta):
     """Abstract base class for crytographic signature verifiers."""
 
     @abc.abstractmethod
@@ -47,8 +44,7 @@ def verify(self, message, signature):
         raise NotImplementedError("Verify must be implemented")
 
 
-@six.add_metaclass(abc.ABCMeta)
-class Signer(object):
+class Signer(metaclass=abc.ABCMeta):
     """Abstract base class for cryptographic signers."""
 
     @abc.abstractproperty
@@ -71,8 +67,7 @@ def sign(self, message):
         raise NotImplementedError("Sign must be implemented")
 
 
-@six.add_metaclass(abc.ABCMeta)
-class FromServiceAccountMixin(object):
+class FromServiceAccountMixin(metaclass=abc.ABCMeta):
     """Mix-in to enable factory constructors for a Signer."""
 
     @abc.abstractmethod
diff --git a/google/auth/downscoped.py b/google/auth/downscoped.py
index a84ac4af6..b4d9d386e 100644
--- a/google/auth/downscoped.py
+++ b/google/auth/downscoped.py
@@ -50,8 +50,6 @@
 
 import datetime
 
-import six
-
 from google.auth import _helpers
 from google.auth import credentials
 from google.auth import exceptions
@@ -224,7 +222,7 @@ def available_resource(self, value):
         Raises:
             google.auth.exceptions.InvalidType: If the value is not a string.
         """
-        if not isinstance(value, six.string_types):
+        if not isinstance(value, str):
             raise exceptions.InvalidType(
                 "The provided available_resource is not a string."
             )
@@ -252,7 +250,7 @@ def available_permissions(self, value):
             InvalidValue: If the value is not valid.
         """
         for available_permission in value:
-            if not isinstance(available_permission, six.string_types):
+            if not isinstance(available_permission, str):
                 raise exceptions.InvalidType(
                     "Provided available_permissions are not a list of strings."
                 )
@@ -355,7 +353,7 @@ def expression(self, value):
         Raises:
             google.auth.exceptions.InvalidType: If the value is not of type string.
         """
-        if not isinstance(value, six.string_types):
+        if not isinstance(value, str):
             raise exceptions.InvalidType("The provided expression is not a string.")
         self._expression = value
 
@@ -378,7 +376,7 @@ def title(self, value):
         Raises:
             google.auth.exceptions.InvalidType: If the value is not of type string or None.
         """
-        if not isinstance(value, six.string_types) and value is not None:
+        if not isinstance(value, str) and value is not None:
             raise exceptions.InvalidType("The provided title is not a string or None.")
         self._title = value
 
@@ -401,7 +399,7 @@ def description(self, value):
         Raises:
             google.auth.exceptions.InvalidType: If the value is not of type string or None.
         """
-        if not isinstance(value, six.string_types) and value is not None:
+        if not isinstance(value, str) and value is not None:
             raise exceptions.InvalidType(
                 "The provided description is not a string or None."
             )
diff --git a/google/auth/external_account.py b/google/auth/external_account.py
index fc311ac2d..001b26f7f 100644
--- a/google/auth/external_account.py
+++ b/google/auth/external_account.py
@@ -34,8 +34,6 @@
 import json
 import re
 
-import six
-
 from google.auth import _helpers
 from google.auth import credentials
 from google.auth import exceptions
@@ -56,11 +54,11 @@
 _DEFAULT_UNIVERSE_DOMAIN = "googleapis.com"
 
 
-@six.add_metaclass(abc.ABCMeta)
 class Credentials(
     credentials.Scoped,
     credentials.CredentialsWithQuotaProject,
     credentials.CredentialsWithTokenUri,
+    metaclass=abc.ABCMeta,
 ):
     """Base class for all external account credentials.
 
diff --git a/google/auth/iam.py b/google/auth/iam.py
index 5d63dc5d8..e9df84417 100644
--- a/google/auth/iam.py
+++ b/google/auth/iam.py
@@ -20,10 +20,9 @@
 """
 
 import base64
+import http.client as http_client
 import json
 
-from six.moves import http_client
-
 from google.auth import _helpers
 from google.auth import crypt
 from google.auth import exceptions
diff --git a/google/auth/impersonated_credentials.py b/google/auth/impersonated_credentials.py
index ba6012123..816b9ea31 100644
--- a/google/auth/impersonated_credentials.py
+++ b/google/auth/impersonated_credentials.py
@@ -28,11 +28,9 @@
 import base64
 import copy
 from datetime import datetime
+import http.client as http_client
 import json
 
-import six
-from six.moves import http_client
-
 from google.auth import _helpers
 from google.auth import credentials
 from google.auth import exceptions
@@ -117,7 +115,7 @@ def _make_iam_token_request(
             ),
             response_body,
         )
-        six.raise_from(new_exc, caught_exc)
+        raise new_exc from caught_exc
 
 
 class Credentials(
diff --git a/google/auth/jwt.py b/google/auth/jwt.py
index 026aec554..1ebd565d4 100644
--- a/google/auth/jwt.py
+++ b/google/auth/jwt.py
@@ -48,10 +48,9 @@
 import copy
 import datetime
 import json
+import urllib
 
 import cachetools
-import six
-from six.moves import urllib
 
 from google.auth import _helpers
 from google.auth import _service_account_info
@@ -125,7 +124,7 @@ def _decode_jwt_segment(encoded_section):
         new_exc = exceptions.MalformedError(
             "Can't parse segment: {0}".format(section_bytes)
         )
-        six.raise_from(new_exc, caught_exc)
+        raise new_exc from caught_exc
 
 
 def _unverified_decode(token):
@@ -269,21 +268,15 @@ def decode(token, certs=None, verify=True, audience=None, clock_skew_in_seconds=
         verifier_cls = _ALGORITHM_TO_VERIFIER_CLASS[key_alg]
     except KeyError as exc:
         if key_alg in _CRYPTOGRAPHY_BASED_ALGORITHMS:
-            six.raise_from(
-                exceptions.InvalidValue(
-                    "The key algorithm {} requires the cryptography package "
-                    "to be installed.".format(key_alg)
-                ),
-                exc,
-            )
+            raise exceptions.InvalidValue(
+                "The key algorithm {} requires the cryptography package to be installed.".format(
+                    key_alg
+                )
+            ) from exc
         else:
-            six.raise_from(
-                exceptions.InvalidValue(
-                    "Unsupported signature algorithm {}".format(key_alg)
-                ),
-                exc,
-            )
-
+            raise exceptions.InvalidValue(
+                "Unsupported signature algorithm {}".format(key_alg)
+            ) from exc
     # If certs is specified as a dictionary of key IDs to certificates, then
     # use the certificate identified by the key ID in the token header.
     if isinstance(certs, Mapping):
diff --git a/google/auth/transport/__init__.py b/google/auth/transport/__init__.py
index 8334145a1..724568e58 100644
--- a/google/auth/transport/__init__.py
+++ b/google/auth/transport/__init__.py
@@ -25,17 +25,13 @@
 """
 
 import abc
-
-import six
-from six.moves import http_client
-
-TOO_MANY_REQUESTS = 429  # Python 2.7 six is missing this status code.
+import http.client as http_client
 
 DEFAULT_RETRYABLE_STATUS_CODES = (
     http_client.INTERNAL_SERVER_ERROR,
     http_client.SERVICE_UNAVAILABLE,
     http_client.REQUEST_TIMEOUT,
-    TOO_MANY_REQUESTS,
+    http_client.TOO_MANY_REQUESTS,
 )
 """Sequence[int]:  HTTP status codes indicating a request can be retried.
 """
@@ -50,8 +46,7 @@
 """int: How many times to refresh the credentials and retry a request."""
 
 
-@six.add_metaclass(abc.ABCMeta)
-class Response(object):
+class Response(metaclass=abc.ABCMeta):
     """HTTP Response data."""
 
     @abc.abstractproperty
@@ -70,8 +65,7 @@ def data(self):
         raise NotImplementedError("data must be implemented.")
 
 
-@six.add_metaclass(abc.ABCMeta)
-class Request(object):
+class Request(metaclass=abc.ABCMeta):
     """Interface for a callable that makes HTTP requests.
 
     Specific transport implementations should provide an implementation of
diff --git a/google/auth/transport/_aiohttp_requests.py b/google/auth/transport/_aiohttp_requests.py
index 364570e31..3a8da917a 100644
--- a/google/auth/transport/_aiohttp_requests.py
+++ b/google/auth/transport/_aiohttp_requests.py
@@ -24,7 +24,6 @@
 import functools
 
 import aiohttp  # type: ignore
-import six
 import urllib3  # type: ignore
 
 from google.auth import exceptions
@@ -191,11 +190,11 @@ async def __call__(
 
         except aiohttp.ClientError as caught_exc:
             new_exc = exceptions.TransportError(caught_exc)
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
 
         except asyncio.TimeoutError as caught_exc:
             new_exc = exceptions.TransportError(caught_exc)
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
 
 
 class AuthorizedSession(aiohttp.ClientSession):
diff --git a/google/auth/transport/_custom_tls_signer.py b/google/auth/transport/_custom_tls_signer.py
index dfef6d00f..07f14df02 100644
--- a/google/auth/transport/_custom_tls_signer.py
+++ b/google/auth/transport/_custom_tls_signer.py
@@ -24,7 +24,6 @@
 import sys
 
 import cffi  # type: ignore
-import six
 
 from google.auth import exceptions
 
@@ -212,7 +211,7 @@ def load_libraries(self):
             new_exc = exceptions.MutualTLSChannelError(
                 "enterprise cert file is invalid", caught_exc
             )
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
         self._offload_lib = load_offload_lib(offload_library)
         self._signer_lib = load_signer_lib(signer_library)
 
diff --git a/google/auth/transport/_http_client.py b/google/auth/transport/_http_client.py
index c153763ef..cec0ab73f 100644
--- a/google/auth/transport/_http_client.py
+++ b/google/auth/transport/_http_client.py
@@ -14,12 +14,10 @@
 
 """Transport adapter for http.client, for internal use only."""
 
+import http.client as http_client
 import logging
 import socket
-
-import six
-from six.moves import http_client
-from six.moves import urllib
+import urllib
 
 from google.auth import exceptions
 from google.auth import transport
@@ -109,7 +107,7 @@ def __call__(
 
         except (http_client.HTTPException, socket.error) as caught_exc:
             new_exc = exceptions.TransportError(caught_exc)
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
 
         finally:
             connection.close()
diff --git a/google/auth/transport/_mtls_helper.py b/google/auth/transport/_mtls_helper.py
index 4dccb1062..1b9b9c285 100644
--- a/google/auth/transport/_mtls_helper.py
+++ b/google/auth/transport/_mtls_helper.py
@@ -20,8 +20,6 @@
 import re
 import subprocess
 
-import six
-
 from google.auth import exceptions
 
 CONTEXT_AWARE_METADATA_PATH = "~/.secureConnect/context_aware_metadata.json"
@@ -82,7 +80,7 @@ def _read_dca_metadata_file(metadata_path):
             metadata = json.load(f)
     except ValueError as caught_exc:
         new_exc = exceptions.ClientCertError(caught_exc)
-        six.raise_from(new_exc, caught_exc)
+        raise new_exc from caught_exc
 
     return metadata
 
@@ -110,7 +108,7 @@ def _run_cert_provider_command(command, expect_encrypted_key=False):
         stdout, stderr = process.communicate()
     except OSError as caught_exc:
         new_exc = exceptions.ClientCertError(caught_exc)
-        six.raise_from(new_exc, caught_exc)
+        raise new_exc from caught_exc
 
     # Check cert provider command execution error.
     if process.returncode != 0:
diff --git a/google/auth/transport/grpc.py b/google/auth/transport/grpc.py
index 55764b6f6..9a817976d 100644
--- a/google/auth/transport/grpc.py
+++ b/google/auth/transport/grpc.py
@@ -19,8 +19,6 @@
 import logging
 import os
 
-import six
-
 from google.auth import environment_vars
 from google.auth import exceptions
 from google.auth.transport import _mtls_helper
@@ -29,13 +27,9 @@
 try:
     import grpc  # type: ignore
 except ImportError as caught_exc:  # pragma: NO COVER
-    six.raise_from(
-        ImportError(
-            "gRPC is not installed, please install the grpcio package "
-            "to use the gRPC transport."
-        ),
-        caught_exc,
-    )
+    raise ImportError(
+        "gRPC is not installed from please install the grpcio package to use the gRPC transport."
+    ) from caught_exc
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -88,7 +82,7 @@ def _get_authorization_headers(self, context):
             self._request, context.method_name, context.service_url, headers
         )
 
-        return list(six.iteritems(headers))
+        return list(headers.items())
 
     def __call__(self, context, callback):
         """Passes authorization metadata into the given callback.
@@ -337,7 +331,7 @@ def ssl_credentials(self):
                 )
             except exceptions.ClientCertError as caught_exc:
                 new_exc = exceptions.MutualTLSChannelError(caught_exc)
-                six.raise_from(new_exc, caught_exc)
+                raise new_exc from caught_exc
         else:
             self._ssl_credentials = grpc.ssl_channel_credentials()
 
diff --git a/google/auth/transport/mtls.py b/google/auth/transport/mtls.py
index b40bfbedf..c5707617f 100644
--- a/google/auth/transport/mtls.py
+++ b/google/auth/transport/mtls.py
@@ -14,8 +14,6 @@
 
 """Utilites for mutual TLS."""
 
-import six
-
 from google.auth import exceptions
 from google.auth.transport import _mtls_helper
 
@@ -53,7 +51,7 @@ def callback():
             _, cert_bytes, key_bytes = _mtls_helper.get_client_cert_and_key()
         except (OSError, RuntimeError, ValueError) as caught_exc:
             new_exc = exceptions.MutualTLSChannelError(caught_exc)
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
 
         return cert_bytes, key_bytes
 
@@ -98,7 +96,7 @@ def callback():
                 key_file.write(key_bytes)
         except (exceptions.ClientCertError, OSError) as caught_exc:
             new_exc = exceptions.MutualTLSChannelError(caught_exc)
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
 
         return cert_path, key_path, passphrase_bytes
 
diff --git a/google/auth/transport/requests.py b/google/auth/transport/requests.py
index 2c746f8d7..b9bcad359 100644
--- a/google/auth/transport/requests.py
+++ b/google/auth/transport/requests.py
@@ -25,21 +25,14 @@
 try:
     import requests
 except ImportError as caught_exc:  # pragma: NO COVER
-    import six
-
-    six.raise_from(
-        ImportError(
-            "The requests library is not installed, please install the "
-            "requests package to use the requests transport."
-        ),
-        caught_exc,
-    )
+    raise ImportError(
+        "The requests library is not installed from please install the requests package to use the requests transport."
+    ) from caught_exc
 import requests.adapters  # pylint: disable=ungrouped-imports
 import requests.exceptions  # pylint: disable=ungrouped-imports
 from requests.packages.urllib3.util.ssl_ import (  # type: ignore
     create_urllib3_context,
 )  # pylint: disable=ungrouped-imports
-import six  # pylint: disable=ungrouped-imports
 
 from google.auth import environment_vars
 from google.auth import exceptions
@@ -196,7 +189,7 @@ def __call__(
             return _Response(response)
         except requests.exceptions.RequestException as caught_exc:
             new_exc = exceptions.TransportError(caught_exc)
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
 
 
 class _MutualTlsAdapter(requests.adapters.HTTPAdapter):
@@ -465,7 +458,7 @@ def configure_mtls_channel(self, client_cert_callback=None):
             import OpenSSL
         except ImportError as caught_exc:
             new_exc = exceptions.MutualTLSChannelError(caught_exc)
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
 
         try:
             (
@@ -485,7 +478,7 @@ def configure_mtls_channel(self, client_cert_callback=None):
             OpenSSL.crypto.Error,
         ) as caught_exc:
             new_exc = exceptions.MutualTLSChannelError(caught_exc)
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
 
     def request(
         self,
diff --git a/google/auth/transport/urllib3.py b/google/auth/transport/urllib3.py
index 4abc26b52..053d6f7b7 100644
--- a/google/auth/transport/urllib3.py
+++ b/google/auth/transport/urllib3.py
@@ -31,19 +31,14 @@
 except ImportError:  # pragma: NO COVER
     certifi = None  # type: ignore
 
-import six
-
 try:
     import urllib3  # type: ignore
     import urllib3.exceptions  # type: ignore
 except ImportError as caught_exc:  # pragma: NO COVER
-    six.raise_from(
-        ImportError(
-            "The urllib3 library is not installed, please install the "
-            "urllib3 package to use the urllib3 transport."
-        ),
-        caught_exc,
-    )
+    raise ImportError(
+        "The urllib3 library is not installed from please install the "
+        "urllib3 package to use the urllib3 transport."
+    ) from caught_exc
 
 from google.auth import environment_vars
 from google.auth import exceptions
@@ -141,7 +136,7 @@ def __call__(
             return _Response(response)
         except urllib3.exceptions.HTTPError as caught_exc:
             new_exc = exceptions.TransportError(caught_exc)
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
 
 
 def _make_default_http():
@@ -333,7 +328,7 @@ def configure_mtls_channel(self, client_cert_callback=None):
             import OpenSSL
         except ImportError as caught_exc:
             new_exc = exceptions.MutualTLSChannelError(caught_exc)
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
 
         try:
             found_cert_key, cert, key = transport._mtls_helper.get_client_cert_and_key(
@@ -350,7 +345,7 @@ def configure_mtls_channel(self, client_cert_callback=None):
             OpenSSL.crypto.Error,
         ) as caught_exc:
             new_exc = exceptions.MutualTLSChannelError(caught_exc)
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
 
         if self._has_user_provided_http:
             self._has_user_provided_http = False
diff --git a/google/oauth2/_client.py b/google/oauth2/_client.py
index e2c9509a9..d2af6c8aa 100644
--- a/google/oauth2/_client.py
+++ b/google/oauth2/_client.py
@@ -24,11 +24,9 @@
 """
 
 import datetime
+import http.client as http_client
 import json
-
-import six
-from six.moves import http_client
-from six.moves import urllib
+import urllib
 
 from google.auth import _exponential_backoff
 from google.auth import _helpers
@@ -61,7 +59,7 @@ def _handle_error_response(response_data, retryable_error):
 
     retryable_error = retryable_error if retryable_error else False
 
-    if isinstance(response_data, six.string_types):
+    if isinstance(response_data, str):
         raise exceptions.RefreshError(response_data, retryable=retryable_error)
     try:
         error_details = "{}: {}".format(
@@ -95,9 +93,7 @@ def _can_retry(status_code, response_data):
         error_desc = response_data.get("error_description") or ""
         error_code = response_data.get("error") or ""
 
-        if not isinstance(error_code, six.string_types) or not isinstance(
-            error_desc, six.string_types
-        ):
+        if not isinstance(error_code, str) or not isinstance(error_desc, str):
             return False
 
         # Per Oauth 2.0 RFC https://www.rfc-editor.org/rfc/rfc6749.html#section-4.1.2.1
@@ -325,7 +321,7 @@ def jwt_grant(request, token_uri, assertion, can_retry=True):
         new_exc = exceptions.RefreshError(
             "No access token in response.", response_data, retryable=False
         )
-        six.raise_from(new_exc, caught_exc)
+        raise new_exc from caught_exc
 
     expiry = _parse_expiry(response_data)
 
@@ -362,7 +358,7 @@ def call_iam_generate_id_token_endpoint(request, signer_email, audience, access_
         new_exc = exceptions.RefreshError(
             "No ID token in response.", response_data, retryable=False
         )
-        six.raise_from(new_exc, caught_exc)
+        raise new_exc from caught_exc
 
     payload = jwt.decode(id_token, verify=False)
     expiry = datetime.datetime.utcfromtimestamp(payload["exp"])
@@ -414,7 +410,7 @@ def id_token_jwt_grant(request, token_uri, assertion, can_retry=True):
         new_exc = exceptions.RefreshError(
             "No ID token in response.", response_data, retryable=False
         )
-        six.raise_from(new_exc, caught_exc)
+        raise new_exc from caught_exc
 
     payload = jwt.decode(id_token, verify=False)
     expiry = datetime.datetime.utcfromtimestamp(payload["exp"])
@@ -445,7 +441,7 @@ def _handle_refresh_grant_response(response_data, refresh_token):
         new_exc = exceptions.RefreshError(
             "No access token in response.", response_data, retryable=False
         )
-        six.raise_from(new_exc, caught_exc)
+        raise new_exc from caught_exc
 
     refresh_token = response_data.get("refresh_token", refresh_token)
     expiry = _parse_expiry(response_data)
diff --git a/google/oauth2/_client_async.py b/google/oauth2/_client_async.py
index 428084a70..2858d862b 100644
--- a/google/oauth2/_client_async.py
+++ b/google/oauth2/_client_async.py
@@ -24,11 +24,9 @@
 """
 
 import datetime
+import http.client as http_client
 import json
-
-import six
-from six.moves import http_client
-from six.moves import urllib
+import urllib
 
 from google.auth import _exponential_backoff
 from google.auth import exceptions
@@ -183,7 +181,7 @@ async def jwt_grant(request, token_uri, assertion, can_retry=True):
         new_exc = exceptions.RefreshError(
             "No access token in response.", response_data, retryable=False
         )
-        six.raise_from(new_exc, caught_exc)
+        raise new_exc from caught_exc
 
     expiry = client._parse_expiry(response_data)
 
@@ -228,7 +226,7 @@ async def id_token_jwt_grant(request, token_uri, assertion, can_retry=True):
         new_exc = exceptions.RefreshError(
             "No ID token in response.", response_data, retryable=False
         )
-        six.raise_from(new_exc, caught_exc)
+        raise new_exc from caught_exc
 
     payload = jwt.decode(id_token, verify=False)
     expiry = datetime.datetime.utcfromtimestamp(payload["exp"])
diff --git a/google/oauth2/_id_token_async.py b/google/oauth2/_id_token_async.py
index c32dfa47d..6594e416a 100644
--- a/google/oauth2/_id_token_async.py
+++ b/google/oauth2/_id_token_async.py
@@ -58,12 +58,10 @@
 .. _CacheControl: https://cachecontrol.readthedocs.io
 """
 
+import http.client as http_client
 import json
 import os
 
-import six
-from six.moves import http_client
-
 from google.auth import environment_vars
 from google.auth import exceptions
 from google.auth import jwt
@@ -264,7 +262,7 @@ async def fetch_id_token(request, audience):
                 "GOOGLE_APPLICATION_CREDENTIALS is not valid service account credentials.",
                 caught_exc,
             )
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
 
     # 2. Try to fetch ID token from metada server if it exists. The code works
     # for GAE and Cloud Run metadata server as well.
diff --git a/google/oauth2/_reauth_async.py b/google/oauth2/_reauth_async.py
index 6b69c6e67..de3675c52 100644
--- a/google/oauth2/_reauth_async.py
+++ b/google/oauth2/_reauth_async.py
@@ -34,8 +34,6 @@
 
 import sys
 
-from six.moves import range
-
 from google.auth import exceptions
 from google.oauth2 import _client
 from google.oauth2 import _client_async
diff --git a/google/oauth2/challenges.py b/google/oauth2/challenges.py
index 6fe982d1c..c55796323 100644
--- a/google/oauth2/challenges.py
+++ b/google/oauth2/challenges.py
@@ -20,8 +20,6 @@
 import getpass
 import sys
 
-import six
-
 from google.auth import _helpers
 from google.auth import exceptions
 
@@ -47,8 +45,7 @@ def get_user_password(text):
     return getpass.getpass(text)
 
 
-@six.add_metaclass(abc.ABCMeta)
-class ReauthChallenge(object):
+class ReauthChallenge(metaclass=abc.ABCMeta):
     """Base class for reauth challenges."""
 
     @property
diff --git a/google/oauth2/credentials.py b/google/oauth2/credentials.py
index 5c40ab097..5becb7c1d 100644
--- a/google/oauth2/credentials.py
+++ b/google/oauth2/credentials.py
@@ -37,8 +37,6 @@
 import logging
 import warnings
 
-import six
-
 from google.auth import _cloud_sdk
 from google.auth import _helpers
 from google.auth import credentials
@@ -307,7 +305,7 @@ def refresh(self, request):
         if self._refresh_token is None and self.refresh_handler:
             token, expiry = self.refresh_handler(request, scopes=scopes)
             # Validate returned data.
-            if not isinstance(token, six.string_types):
+            if not isinstance(token, str):
                 raise exceptions.RefreshError(
                     "The refresh_handler returned token is not a string."
                 )
@@ -394,7 +392,7 @@ def from_authorized_user_info(cls, info, scopes=None):
             ValueError: If the info is not in the expected format.
         """
         keys_needed = set(("refresh_token", "client_id", "client_secret"))
-        missing = keys_needed.difference(six.iterkeys(info))
+        missing = keys_needed.difference(info.keys())
 
         if missing:
             raise ValueError(
@@ -414,7 +412,7 @@ def from_authorized_user_info(cls, info, scopes=None):
         # process scopes, which needs to be a seq
         if scopes is None and "scopes" in info:
             scopes = info.get("scopes")
-            if isinstance(scopes, six.string_types):
+            if isinstance(scopes, str):
                 scopes = scopes.split(" ")
 
         return cls(
diff --git a/google/oauth2/id_token.py b/google/oauth2/id_token.py
index 48f5b0a59..2b1abec2b 100644
--- a/google/oauth2/id_token.py
+++ b/google/oauth2/id_token.py
@@ -55,12 +55,10 @@
 .. _CacheControl: https://cachecontrol.readthedocs.io
 """
 
+import http.client as http_client
 import json
 import os
 
-import six
-from six.moves import http_client
-
 from google.auth import environment_vars
 from google.auth import exceptions
 from google.auth import jwt
@@ -274,7 +272,7 @@ def fetch_id_token_credentials(audience, request=None):
                 "GOOGLE_APPLICATION_CREDENTIALS is not valid service account credentials.",
                 caught_exc,
             )
-            six.raise_from(new_exc, caught_exc)
+            raise new_exc from caught_exc
 
     # 2. Try to fetch ID token from metada server if it exists. The code
     # works for GAE and Cloud Run metadata server as well.
diff --git a/google/oauth2/reauth.py b/google/oauth2/reauth.py
index c679a9e8b..587034773 100644
--- a/google/oauth2/reauth.py
+++ b/google/oauth2/reauth.py
@@ -34,8 +34,6 @@
 
 import sys
 
-from six.moves import range
-
 from google.auth import exceptions
 from google.auth import metrics
 from google.oauth2 import _client
diff --git a/google/oauth2/sts.py b/google/oauth2/sts.py
index 5cf06d4d4..ad3962735 100644
--- a/google/oauth2/sts.py
+++ b/google/oauth2/sts.py
@@ -31,10 +31,9 @@
 .. _rfc8693 section 2.2.1: https://tools.ietf.org/html/rfc8693#section-2.2.1
 """
 
+import http.client as http_client
 import json
-
-from six.moves import http_client
-from six.moves import urllib
+import urllib
 
 from google.oauth2 import utils
 
diff --git a/google/oauth2/utils.py b/google/oauth2/utils.py
index 593f03236..d72ff1916 100644
--- a/google/oauth2/utils.py
+++ b/google/oauth2/utils.py
@@ -45,8 +45,6 @@
 import enum
 import json
 
-import six
-
 from google.auth import exceptions
 
 
@@ -77,8 +75,7 @@ def __init__(self, client_auth_type, client_id, client_secret=None):
         self.client_secret = client_secret
 
 
-@six.add_metaclass(abc.ABCMeta)
-class OAuthClientAuthHandler(object):
+class OAuthClientAuthHandler(metaclass=abc.ABCMeta):
     """Abstract class for handling client authentication in OAuth-based
     operations.
     """
diff --git a/noxfile.py b/noxfile.py
index b9d183385..48b0347d1 100644
--- a/noxfile.py
+++ b/noxfile.py
@@ -79,7 +79,6 @@ def mypy(session):
         "types-pyOpenSSL",
         "types-requests",
         "types-setuptools",
-        "types-six",
         "types-mock",
     )
     session.run("mypy", "-p", "google", "-p", "tests", "-p", "tests_async")
diff --git a/setup.py b/setup.py
index 4a91925dd..b3c0e6de2 100644
--- a/setup.py
+++ b/setup.py
@@ -26,7 +26,6 @@
     # https://github.com/sybrenstuvel/python-rsa/issues/152#issuecomment-643470233
     "rsa>=3.1.4,<5",
     # install enum34 to support 2.7. enum34 only works up to python version 3.3.
-    "six>=1.9.0",
     "urllib3<2.0",
 )
 
diff --git a/system_tests/noxfile.py b/system_tests/noxfile.py
index e44dc5660..eb22108bb 100644
--- a/system_tests/noxfile.py
+++ b/system_tests/noxfile.py
@@ -283,6 +283,7 @@ def compute_engine(session):
 @nox.session(python=PYTHON_VERSIONS_SYNC)
 def grpc(session):
     session.install(LIBRARY_DIR)
+    session.install("six")
     session.install(*TEST_DEPENDENCIES_SYNC, "google-cloud-pubsub==1.7.2")
     session.env[EXPLICIT_CREDENTIALS_ENV] = SERVICE_ACCOUNT_FILE
     default(
diff --git a/system_tests/secrets.tar.enc b/system_tests/secrets.tar.enc
index 0c81b08f5..15589afb9 100644
Binary files a/system_tests/secrets.tar.enc and b/system_tests/secrets.tar.enc differ
diff --git a/system_tests/system_tests_sync/test_external_accounts.py b/system_tests/system_tests_sync/test_external_accounts.py
index e7a81963b..837d0064b 100644
--- a/system_tests/system_tests_sync/test_external_accounts.py
+++ b/system_tests/system_tests_sync/test_external_accounts.py
@@ -44,7 +44,8 @@
 import google.auth
 from google.auth import _helpers
 from googleapiclient import discovery
-from six.moves import BaseHTTPServer
+from http.server import BaseHTTPRequestHandler
+from http.server import HTTPServer
 from google.oauth2 import service_account
 import pytest
 from mock import patch
@@ -245,7 +246,7 @@ def check_impersonation_expiration():
 # This test makes sure that setting up an http server to provide credentials
 # works to allow access to Google resources.
 def test_url_based_external_account(dns_access, oidc_credentials, service_account_info):
-    class TestResponseHandler(BaseHTTPServer.BaseHTTPRequestHandler):
+    class TestResponseHandler(BaseHTTPRequestHandler):
         def do_GET(self):
             if self.headers["my-header"] != "expected-value":
                 self.send_response(400)
@@ -269,7 +270,7 @@ def do_GET(self):
                     json.dumps({"access_token": oidc_credentials.token}).encode("utf-8")
                 )
 
-    class TestHTTPServer(BaseHTTPServer.HTTPServer, object):
+    class TestHTTPServer(HTTPServer, object):
         def __init__(self):
             self.port = self._find_open_port()
             super(TestHTTPServer, self).__init__(("", self.port), TestResponseHandler)
diff --git a/tests/compute_engine/test__metadata.py b/tests/compute_engine/test__metadata.py
index f543426d3..a940feb25 100644
--- a/tests/compute_engine/test__metadata.py
+++ b/tests/compute_engine/test__metadata.py
@@ -13,13 +13,13 @@
 # limitations under the License.
 
 import datetime
+import http.client as http_client
+import importlib
 import json
 import os
 
 import mock
 import pytest  # type: ignore
-from six.moves import http_client
-from six.moves import reload_module
 
 from google.auth import _helpers
 from google.auth import environment_vars
@@ -144,13 +144,13 @@ def test_ping_success_custom_root(mock_metrics_header_value):
 
     fake_ip = "1.2.3.4"
     os.environ[environment_vars.GCE_METADATA_IP] = fake_ip
-    reload_module(_metadata)
+    importlib.reload(_metadata)
 
     try:
         assert _metadata.ping(request)
     finally:
         del os.environ[environment_vars.GCE_METADATA_IP]
-        reload_module(_metadata)
+        importlib.reload(_metadata)
 
     request.assert_called_once_with(
         method="GET",
@@ -257,13 +257,13 @@ def test_get_success_custom_root_new_variable():
 
     fake_root = "another.metadata.service"
     os.environ[environment_vars.GCE_METADATA_HOST] = fake_root
-    reload_module(_metadata)
+    importlib.reload(_metadata)
 
     try:
         _metadata.get(request, PATH)
     finally:
         del os.environ[environment_vars.GCE_METADATA_HOST]
-        reload_module(_metadata)
+        importlib.reload(_metadata)
 
     request.assert_called_once_with(
         method="GET",
@@ -277,13 +277,13 @@ def test_get_success_custom_root_old_variable():
 
     fake_root = "another.metadata.service"
     os.environ[environment_vars.GCE_METADATA_ROOT] = fake_root
-    reload_module(_metadata)
+    importlib.reload(_metadata)
 
     try:
         _metadata.get(request, PATH)
     finally:
         del os.environ[environment_vars.GCE_METADATA_ROOT]
-        reload_module(_metadata)
+        importlib.reload(_metadata)
 
     request.assert_called_once_with(
         method="GET",
diff --git a/tests/crypt/test__python_rsa.py b/tests/crypt/test__python_rsa.py
index 9d832f044..4a4ebe44e 100644
--- a/tests/crypt/test__python_rsa.py
+++ b/tests/crypt/test__python_rsa.py
@@ -12,6 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import io
 import json
 import os
 
@@ -19,7 +20,6 @@
 from pyasn1_modules import pem  # type: ignore
 import pytest  # type: ignore
 import rsa  # type: ignore
-import six
 
 from google.auth import _helpers
 from google.auth.crypt import _python_rsa
@@ -141,7 +141,7 @@ def test_from_string_pkcs8(self):
     def test_from_string_pkcs8_extra_bytes(self):
         key_bytes = PKCS8_KEY_BYTES
         _, pem_bytes = pem.readPemBlocksFromFile(
-            six.StringIO(_helpers.from_bytes(key_bytes)), _python_rsa._PKCS8_MARKER
+            io.StringIO(_helpers.from_bytes(key_bytes)), _python_rsa._PKCS8_MARKER
         )
 
         key_info, remaining = None, "extra"
diff --git a/tests/oauth2/test__client.py b/tests/oauth2/test__client.py
index 9450fa1fd..4cbd3a8ad 100644
--- a/tests/oauth2/test__client.py
+++ b/tests/oauth2/test__client.py
@@ -13,14 +13,13 @@
 # limitations under the License.
 
 import datetime
+import http.client as http_client
 import json
 import os
+import urllib
 
 import mock
 import pytest  # type: ignore
-import six
-from six.moves import http_client
-from six.moves import urllib
 
 from google.auth import _helpers
 from google.auth import crypt
@@ -273,7 +272,7 @@ def verify_request_params(request, params):
     request_body = request.call_args[1]["body"].decode("utf-8")
     request_params = urllib.parse.parse_qs(request_body)
 
-    for key, value in six.iteritems(params):
+    for key, value in params.items():
         assert request_params[key][0] == value
 
 
diff --git a/tests/oauth2/test_gdch_credentials.py b/tests/oauth2/test_gdch_credentials.py
index 60944ed41..63075aba0 100644
--- a/tests/oauth2/test_gdch_credentials.py
+++ b/tests/oauth2/test_gdch_credentials.py
@@ -20,7 +20,6 @@
 import mock
 import pytest  # type: ignore
 import requests
-import six
 
 from google.auth import exceptions
 from google.auth import jwt
@@ -69,7 +68,7 @@ def test__create_jwt(self):
         expected_iss_sub_value = (
             "system:serviceaccount:project_foo:service_identity_name"
         )
-        assert isinstance(jwt_token, six.text_type)
+        assert isinstance(jwt_token, str)
         assert header["alg"] == "ES256"
         assert header["kid"] == self.PRIVATE_KEY_ID
         assert payload["iss"] == expected_iss_sub_value
diff --git a/tests/oauth2/test_service_account.py b/tests/oauth2/test_service_account.py
index 36565b721..058fc3f7d 100644
--- a/tests/oauth2/test_service_account.py
+++ b/tests/oauth2/test_service_account.py
@@ -18,7 +18,6 @@
 
 import mock
 import pytest  # type: ignore
-import six
 
 from google.auth import _helpers
 from google.auth import crypt
@@ -525,7 +524,7 @@ def test_refresh_with_jwt_credentials_token_type_check(self):
         credentials.refresh(mock.Mock())
 
         # Credentials token should be a JWT string.
-        assert isinstance(credentials.token, six.string_types)
+        assert isinstance(credentials.token, str)
         payload = jwt.decode(credentials.token, verify=False)
         assert payload["aud"] == "https://pubsub.googleapis.com"
 
diff --git a/tests/oauth2/test_sts.py b/tests/oauth2/test_sts.py
index a543d42a8..e0fb4ae23 100644
--- a/tests/oauth2/test_sts.py
+++ b/tests/oauth2/test_sts.py
@@ -12,12 +12,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import http.client as http_client
 import json
+import urllib
 
 import mock
 import pytest  # type: ignore
-from six.moves import http_client
-from six.moves import urllib
 
 from google.auth import exceptions
 from google.auth import transport
diff --git a/tests/test__helpers.py b/tests/test__helpers.py
index 8c71f3e51..c1f1d812e 100644
--- a/tests/test__helpers.py
+++ b/tests/test__helpers.py
@@ -13,9 +13,9 @@
 # limitations under the License.
 
 import datetime
+import urllib
 
 import pytest  # type: ignore
-from six.moves import urllib
 
 from google.auth import _helpers
 
diff --git a/tests/test__oauth2client.py b/tests/test__oauth2client.py
index 8802ba17f..9f0c192ae 100644
--- a/tests/test__oauth2client.py
+++ b/tests/test__oauth2client.py
@@ -13,12 +13,12 @@
 # limitations under the License.
 
 import datetime
+import importlib
 import os
 import sys
 
 import mock
 import pytest  # type: ignore
-from six.moves import reload_module
 
 try:
     import oauth2client.client  # type: ignore
@@ -159,19 +159,19 @@ def test_convert_not_found():
 @pytest.fixture
 def reset__oauth2client_module():
     """Reloads the _oauth2client module after a test."""
-    reload_module(_oauth2client)
+    importlib.reload(_oauth2client)
 
 
 def test_import_has_app_engine(
     mock_oauth2client_gae_imports, reset__oauth2client_module
 ):
-    reload_module(_oauth2client)
+    importlib.reload(_oauth2client)
     assert _oauth2client._HAS_APPENGINE
 
 
 def test_import_without_oauth2client(monkeypatch, reset__oauth2client_module):
     monkeypatch.setitem(sys.modules, "oauth2client", None)
     with pytest.raises(ImportError) as excinfo:
-        reload_module(_oauth2client)
+        importlib.reload(_oauth2client)
 
     assert excinfo.match("oauth2client")
diff --git a/tests/test__service_account_info.py b/tests/test__service_account_info.py
index 9ad9f0fc8..4fa85a599 100644
--- a/tests/test__service_account_info.py
+++ b/tests/test__service_account_info.py
@@ -16,7 +16,6 @@
 import os
 
 import pytest  # type: ignore
-import six
 
 from google.auth import _service_account_info
 from google.auth import crypt
@@ -67,7 +66,7 @@ def test_from_dict_bad_format():
 def test_from_filename():
     info, signer = _service_account_info.from_filename(SERVICE_ACCOUNT_JSON_FILE)
 
-    for key, value in six.iteritems(SERVICE_ACCOUNT_INFO):
+    for key, value in SERVICE_ACCOUNT_INFO.items():
         assert info[key] == value
 
     assert isinstance(signer, crypt.RSASigner)
diff --git a/tests/test_aws.py b/tests/test_aws.py
index 1c8c5d41a..39138ab12 100644
--- a/tests/test_aws.py
+++ b/tests/test_aws.py
@@ -13,13 +13,13 @@
 # limitations under the License.
 
 import datetime
+import http.client as http_client
 import json
 import os
+import urllib.parse
 
 import mock
 import pytest  # type: ignore
-from six.moves import http_client
-from six.moves import urllib
 
 from google.auth import _helpers
 from google.auth import aws
diff --git a/tests/test_downscoped.py b/tests/test_downscoped.py
index 7d0768a18..b011380bd 100644
--- a/tests/test_downscoped.py
+++ b/tests/test_downscoped.py
@@ -13,12 +13,12 @@
 # limitations under the License.
 
 import datetime
+import http.client as http_client
 import json
+import urllib
 
 import mock
 import pytest  # type: ignore
-from six.moves import http_client
-from six.moves import urllib
 
 from google.auth import _helpers
 from google.auth import credentials
diff --git a/tests/test_external_account.py b/tests/test_external_account.py
index f05a5a11a..fd511aa44 100644
--- a/tests/test_external_account.py
+++ b/tests/test_external_account.py
@@ -13,12 +13,12 @@
 # limitations under the License.
 
 import datetime
+import http.client as http_client
 import json
+import urllib
 
 import mock
 import pytest  # type: ignore
-from six.moves import http_client
-from six.moves import urllib
 
 from google.auth import _helpers
 from google.auth import exceptions
diff --git a/tests/test_external_account_authorized_user.py b/tests/test_external_account_authorized_user.py
index db18450a8..7ffd5078c 100644
--- a/tests/test_external_account_authorized_user.py
+++ b/tests/test_external_account_authorized_user.py
@@ -13,11 +13,11 @@
 # limitations under the License.
 
 import datetime
+import http.client as http_client
 import json
 
 import mock
 import pytest  # type: ignore
-from six.moves import http_client
 
 from google.auth import exceptions
 from google.auth import external_account_authorized_user
diff --git a/tests/test_iam.py b/tests/test_iam.py
index ae482765b..6706afb4b 100644
--- a/tests/test_iam.py
+++ b/tests/test_iam.py
@@ -14,11 +14,11 @@
 
 import base64
 import datetime
+import http.client as http_client
 import json
 
 import mock
 import pytest  # type: ignore
-from six.moves import http_client
 
 from google.auth import _helpers
 from google.auth import exceptions
diff --git a/tests/test_identity_pool.py b/tests/test_identity_pool.py
index 7262e644c..e469cf731 100644
--- a/tests/test_identity_pool.py
+++ b/tests/test_identity_pool.py
@@ -13,13 +13,13 @@
 # limitations under the License.
 
 import datetime
+import http.client as http_client
 import json
 import os
+import urllib
 
 import mock
 import pytest  # type: ignore
-from six.moves import http_client
-from six.moves import urllib
 
 from google.auth import _helpers
 from google.auth import exceptions
diff --git a/tests/test_impersonated_credentials.py b/tests/test_impersonated_credentials.py
index f79db8f6a..161ff3b04 100644
--- a/tests/test_impersonated_credentials.py
+++ b/tests/test_impersonated_credentials.py
@@ -13,15 +13,12 @@
 # limitations under the License.
 
 import datetime
+import http.client as http_client
 import json
 import os
 
-# Because Python 2.7
-# from typing import List
-
 import mock
 import pytest  # type: ignore
-from six.moves import http_client
 
 from google.auth import _helpers
 from google.auth import crypt
diff --git a/tests/test_pluggable.py b/tests/test_pluggable.py
index 7d601dfd4..9b0da9273 100644
--- a/tests/test_pluggable.py
+++ b/tests/test_pluggable.py
@@ -12,7 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# import datetime
 import json
 import os
 import subprocess
@@ -20,17 +19,10 @@
 import mock
 import pytest  # type: ignore
 
-# from six.moves import http_client
-# from six.moves import urllib
-
-# from google.auth import _helpers
 from google.auth import exceptions
 from google.auth import pluggable
 from tests.test__default import WORKFORCE_AUDIENCE
 
-# from google.auth import transport
-
-
 CLIENT_ID = "username"
 CLIENT_SECRET = "password"
 # Base64 encoding of "username:password".
diff --git a/tests/transport/compliance.py b/tests/transport/compliance.py
index faf39b9ba..b3cd7e823 100644
--- a/tests/transport/compliance.py
+++ b/tests/transport/compliance.py
@@ -12,12 +12,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import http.client as http_client
 import time
 
 import flask  # type: ignore
 import pytest  # type: ignore
 from pytest_localserver.http import WSGIServer  # type: ignore
-from six.moves import http_client
 
 from google.auth import exceptions
 
diff --git a/tests/transport/test_requests.py b/tests/transport/test_requests.py
index 9532117b5..d96281434 100644
--- a/tests/transport/test_requests.py
+++ b/tests/transport/test_requests.py
@@ -14,6 +14,7 @@
 
 import datetime
 import functools
+import http.client as http_client
 import os
 import sys
 
@@ -23,7 +24,6 @@
 import pytest  # type: ignore
 import requests
 import requests.adapters
-from six.moves import http_client
 
 from google.auth import environment_vars
 from google.auth import exceptions
diff --git a/tests/transport/test_urllib3.py b/tests/transport/test_urllib3.py
index 5bdfac95e..e83230032 100644
--- a/tests/transport/test_urllib3.py
+++ b/tests/transport/test_urllib3.py
@@ -12,13 +12,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import http.client as http_client
 import os
 import sys
 
 import mock
 import OpenSSL
 import pytest  # type: ignore
-from six.moves import http_client
 import urllib3  # type: ignore
 
 from google.auth import environment_vars
diff --git a/tests_async/oauth2/test__client_async.py b/tests_async/oauth2/test__client_async.py
index 402083672..add1b4e60 100644
--- a/tests_async/oauth2/test__client_async.py
+++ b/tests_async/oauth2/test__client_async.py
@@ -13,13 +13,12 @@
 # limitations under the License.
 
 import datetime
+import http.client as http_client
 import json
+import urllib
 
 import mock
 import pytest  # type: ignore
-import six
-from six.moves import http_client
-from six.moves import urllib
 
 from google.auth import _helpers
 from google.auth import _jwt_async as jwt
@@ -202,7 +201,7 @@ def verify_request_params(request, params):
     request_body = request.call_args[1]["body"].decode("utf-8")
     request_params = urllib.parse.parse_qs(request_body)
 
-    for key, value in six.iteritems(params):
+    for key, value in params.items():
         assert request_params[key][0] == value
 
 
diff --git a/tests_async/transport/async_compliance.py b/tests_async/transport/async_compliance.py
index 36fe7a301..f3a36079c 100644
--- a/tests_async/transport/async_compliance.py
+++ b/tests_async/transport/async_compliance.py
@@ -12,12 +12,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import http.client as http_client
 import time
 
 import flask  # type: ignore
 import pytest  # type: ignore
 from pytest_localserver.http import WSGIServer  # type: ignore
-from six.moves import http_client
 
 from google.auth import exceptions
 from tests.transport import compliance