diff --git a/google/__init__.py b/google/__init__.py
index 0d0a4c3ab..70a7bd995 100644
--- a/google/__init__.py
+++ b/google/__init__.py
@@ -21,4 +21,4 @@
 except ImportError:
     import pkgutil
 
-    __path__ = pkgutil.extend_path(__path__, __name__)
+    __path__ = pkgutil.extend_path(__path__, __name__)  # type: ignore
diff --git a/google/auth/_jwt_async.py b/google/auth/_jwt_async.py
index 49e3026e5..3a1abc5b8 100644
--- a/google/auth/_jwt_async.py
+++ b/google/auth/_jwt_async.py
@@ -43,7 +43,7 @@
 change in minor releases.
 """
 
-import google.auth
+from google.auth import _credentials_async
 from google.auth import jwt
 
 
@@ -91,9 +91,7 @@ def decode(token, certs=None, verify=True, audience=None):
 
 
 class Credentials(
-    jwt.Credentials,
-    google.auth._credentials_async.Signing,
-    google.auth._credentials_async.Credentials,
+    jwt.Credentials, _credentials_async.Signing, _credentials_async.Credentials
 ):
     """Credentials that use a JWT as the bearer token.
 
@@ -146,9 +144,7 @@ class Credentials(
 
 
 class OnDemandCredentials(
-    jwt.OnDemandCredentials,
-    google.auth._credentials_async.Signing,
-    google.auth._credentials_async.Credentials,
+    jwt.OnDemandCredentials, _credentials_async.Signing, _credentials_async.Credentials
 ):
     """On-demand JWT credentials.
 
diff --git a/google/auth/_oauth2client.py b/google/auth/_oauth2client.py
index 95a9876f3..a86ba8dd6 100644
--- a/google/auth/_oauth2client.py
+++ b/google/auth/_oauth2client.py
@@ -30,14 +30,14 @@
 import google.oauth2.service_account
 
 try:
-    import oauth2client.client
-    import oauth2client.contrib.gce
-    import oauth2client.service_account
+    import oauth2client.client  # type: ignore
+    import oauth2client.contrib.gce  # type: ignore
+    import oauth2client.service_account  # type: ignore
 except ImportError as caught_exc:
     six.raise_from(ImportError("oauth2client is not installed."), caught_exc)
 
 try:
-    import oauth2client.contrib.appengine  # pytype: disable=import-error
+    import oauth2client.contrib.appengine  # type: ignore
 
     _HAS_APPENGINE = True
 except ImportError:
diff --git a/google/auth/app_engine.py b/google/auth/app_engine.py
index 81aef73b4..1460a7d1a 100644
--- a/google/auth/app_engine.py
+++ b/google/auth/app_engine.py
@@ -30,9 +30,9 @@
 
 # pytype: disable=import-error
 try:
-    from google.appengine.api import app_identity
+    from google.appengine.api import app_identity  # type: ignore
 except ImportError:
-    app_identity = None
+    app_identity = None  # type: ignore
 # pytype: enable=import-error
 
 
@@ -168,12 +168,12 @@ def with_quota_project(self, quota_project_id):
     def sign_bytes(self, message):
         return self._signer.sign(message)
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(credentials.Signing)
     def signer_email(self):
         return self.service_account_email
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(credentials.Signing)
     def signer(self):
         return self._signer
diff --git a/google/auth/aws.py b/google/auth/aws.py
index 925b1ddfb..2fd96d058 100644
--- a/google/auth/aws.py
+++ b/google/auth/aws.py
@@ -45,14 +45,9 @@
 import posixpath
 import re
 
-try:
-    from urllib.parse import urljoin
-# Python 2.7 compatibility
-except ImportError:  # pragma: NO COVER
-    from urlparse import urljoin
-
 from six.moves import http_client
 from six.moves import urllib
+from six.moves.urllib.parse import urljoin
 
 from google.auth import _helpers
 from google.auth import environment_vars
diff --git a/google/auth/compute_engine/credentials.py b/google/auth/compute_engine/credentials.py
index b39ac50ae..59b48dae6 100644
--- a/google/auth/compute_engine/credentials.py
+++ b/google/auth/compute_engine/credentials.py
@@ -379,7 +379,7 @@ def refresh(self, request):
             self.token = access_token
             self.expiry = expiry
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(credentials.Signing)
     def signer(self):
         return self._signer
diff --git a/google/auth/crypt/__init__.py b/google/auth/crypt/__init__.py
index 15ac95068..9f91f0d0b 100644
--- a/google/auth/crypt/__init__.py
+++ b/google/auth/crypt/__init__.py
@@ -45,7 +45,7 @@
 try:
     from google.auth.crypt import es256
 except ImportError:  # pragma: NO COVER
-    es256 = None
+    es256 = None  # type: ignore
 
 if es256 is not None:  # pragma: NO COVER
     __all__ = [
diff --git a/google/auth/crypt/_cryptography_rsa.py b/google/auth/crypt/_cryptography_rsa.py
index 916c9d80a..4f2d61166 100644
--- a/google/auth/crypt/_cryptography_rsa.py
+++ b/google/auth/crypt/_cryptography_rsa.py
@@ -101,7 +101,7 @@ def __init__(self, private_key, key_id=None):
         self._key = private_key
         self._key_id = key_id
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(base.Signer)
     def key_id(self):
         return self._key_id
diff --git a/google/auth/crypt/_python_rsa.py b/google/auth/crypt/_python_rsa.py
index ec30dd09a..797a2592b 100644
--- a/google/auth/crypt/_python_rsa.py
+++ b/google/auth/crypt/_python_rsa.py
@@ -21,11 +21,11 @@
 
 from __future__ import absolute_import
 
-from pyasn1.codec.der import decoder
-from pyasn1_modules import pem
-from pyasn1_modules.rfc2459 import Certificate
-from pyasn1_modules.rfc5208 import PrivateKeyInfo
-import rsa
+from pyasn1.codec.der import decoder  # type: ignore
+from pyasn1_modules import pem  # type: ignore
+from pyasn1_modules.rfc2459 import Certificate  # type: ignore
+from pyasn1_modules.rfc5208 import PrivateKeyInfo  # type: ignore
+import rsa  # type: ignore
 import six
 
 from google.auth import _helpers
@@ -125,7 +125,7 @@ def __init__(self, private_key, key_id=None):
         self._key = private_key
         self._key_id = key_id
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(base.Signer)
     def key_id(self):
         return self._key_id
diff --git a/google/auth/crypt/es256.py b/google/auth/crypt/es256.py
index 42823a7a5..7920cc7ff 100644
--- a/google/auth/crypt/es256.py
+++ b/google/auth/crypt/es256.py
@@ -15,7 +15,7 @@
 """ECDSA (ES256) verifier and signer that use the ``cryptography`` library.
 """
 
-from cryptography import utils
+from cryptography import utils  # type: ignore
 import cryptography.exceptions
 from cryptography.hazmat import backends
 from cryptography.hazmat.primitives import hashes
@@ -117,7 +117,7 @@ def __init__(self, private_key, key_id=None):
         self._key = private_key
         self._key_id = key_id
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(base.Signer)
     def key_id(self):
         return self._key_id
diff --git a/google/auth/crypt/rsa.py b/google/auth/crypt/rsa.py
index 8b2d64c10..ed842d1eb 100644
--- a/google/auth/crypt/rsa.py
+++ b/google/auth/crypt/rsa.py
@@ -26,5 +26,5 @@
     # unavailable.
     from google.auth.crypt import _python_rsa
 
-    RSASigner = _python_rsa.RSASigner
-    RSAVerifier = _python_rsa.RSAVerifier
+    RSASigner = _python_rsa.RSASigner  # type: ignore
+    RSAVerifier = _python_rsa.RSAVerifier  # type: ignore
diff --git a/google/auth/jwt.py b/google/auth/jwt.py
index d56559510..9d7b76e73 100644
--- a/google/auth/jwt.py
+++ b/google/auth/jwt.py
@@ -44,7 +44,7 @@
     from collections.abc import Mapping
 # Python 2.7 compatibility
 except ImportError:  # pragma: NO COVER
-    from collections import Mapping
+    from collections import Mapping  # type: ignore
 import copy
 import datetime
 import json
@@ -62,7 +62,7 @@
 try:
     from google.auth.crypt import es256
 except ImportError:  # pragma: NO COVER
-    es256 = None
+    es256 = None  # type: ignore
 
 _DEFAULT_TOKEN_LIFETIME_SECS = 3600  # 1 hour in seconds
 _DEFAULT_MAX_CACHE_SIZE = 10
@@ -70,7 +70,7 @@
 _CRYPTOGRAPHY_BASED_ALGORITHMS = frozenset(["ES256"])
 
 if es256 is not None:  # pragma: NO COVER
-    _ALGORITHM_TO_VERIFIER_CLASS["ES256"] = es256.ES256Verifier
+    _ALGORITHM_TO_VERIFIER_CLASS["ES256"] = es256.ES256Verifier  # type: ignore
 
 
 def encode(signer, payload, header=None, key_id=None):
@@ -557,12 +557,12 @@ def refresh(self, request):
     def sign_bytes(self, message):
         return self._signer.sign(message)
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(google.auth.credentials.Signing)
     def signer_email(self):
         return self._issuer
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(google.auth.credentials.Signing)
     def signer(self):
         return self._signer
@@ -846,12 +846,12 @@ def before_request(self, request, method, url, headers):
     def sign_bytes(self, message):
         return self._signer.sign(message)
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(google.auth.credentials.Signing)
     def signer_email(self):
         return self._issuer
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(google.auth.credentials.Signing)
     def signer(self):
         return self._signer
diff --git a/google/auth/py.typed b/google/auth/py.typed
new file mode 100644
index 000000000..aa7b68923
--- /dev/null
+++ b/google/auth/py.typed
@@ -0,0 +1,2 @@
+# Marker file for PEP 561.
+# The google-auth package uses inline types.
diff --git a/google/auth/transport/_aiohttp_requests.py b/google/auth/transport/_aiohttp_requests.py
index ab7dfef67..8a20e7abe 100644
--- a/google/auth/transport/_aiohttp_requests.py
+++ b/google/auth/transport/_aiohttp_requests.py
@@ -23,9 +23,9 @@
 import asyncio
 import functools
 
-import aiohttp
+import aiohttp  # type: ignore
 import six
-import urllib3
+import urllib3  # type: ignore
 
 from google.auth import exceptions
 from google.auth import transport
diff --git a/google/auth/transport/grpc.py b/google/auth/transport/grpc.py
index c47cb3dda..87fa5042f 100644
--- a/google/auth/transport/grpc.py
+++ b/google/auth/transport/grpc.py
@@ -27,7 +27,7 @@
 from google.oauth2 import service_account
 
 try:
-    import grpc
+    import grpc  # type: ignore
 except ImportError as caught_exc:  # pragma: NO COVER
     six.raise_from(
         ImportError(
diff --git a/google/auth/transport/requests.py b/google/auth/transport/requests.py
index 817176bef..9c6f6c888 100644
--- a/google/auth/transport/requests.py
+++ b/google/auth/transport/requests.py
@@ -205,7 +205,7 @@ class _MutualTlsAdapter(requests.adapters.HTTPAdapter):
     def __init__(self, cert, key):
         import certifi
         from OpenSSL import crypto
-        import urllib3.contrib.pyopenssl
+        import urllib3.contrib.pyopenssl  # type: ignore
 
         urllib3.contrib.pyopenssl.inject_into_urllib3()
 
diff --git a/google/auth/transport/urllib3.py b/google/auth/transport/urllib3.py
index 6a2504d97..ad67327a4 100644
--- a/google/auth/transport/urllib3.py
+++ b/google/auth/transport/urllib3.py
@@ -29,13 +29,14 @@
 try:
     import certifi
 except ImportError:  # pragma: NO COVER
-    certifi = None
+    certifi = None  # type: ignore
+
+import six
 
 try:
-    import urllib3
+    import urllib3  # type: ignore
+    import urllib3.exceptions  # type: ignore
 except ImportError as caught_exc:  # pragma: NO COVER
-    import six
-
     six.raise_from(
         ImportError(
             "The urllib3 library is not installed, please install the "
@@ -43,8 +44,6 @@
         ),
         caught_exc,
     )
-import six
-import urllib3.exceptions  # pylint: disable=ungrouped-imports
 
 from google.auth import environment_vars
 from google.auth import exceptions
@@ -169,7 +168,7 @@ def _make_mutual_tls_http(cert, key):
     """
     import certifi
     from OpenSSL import crypto
-    import urllib3.contrib.pyopenssl
+    import urllib3.contrib.pyopenssl  # type: ignore
 
     urllib3.contrib.pyopenssl.inject_into_urllib3()
     ctx = urllib3.util.ssl_.create_urllib3_context()
diff --git a/google/oauth2/challenges.py b/google/oauth2/challenges.py
index 95e76cb32..bb523e6ca 100644
--- a/google/oauth2/challenges.py
+++ b/google/oauth2/challenges.py
@@ -114,9 +114,9 @@ def is_locally_eligible(self):
     @_helpers.copy_docstring(ReauthChallenge)
     def obtain_challenge_input(self, metadata):
         try:
-            import pyu2f.convenience.authenticator
-            import pyu2f.errors
-            import pyu2f.model
+            import pyu2f.convenience.authenticator  # type: ignore
+            import pyu2f.errors  # type: ignore
+            import pyu2f.model  # type: ignore
         except ImportError:
             raise exceptions.ReauthFailError(
                 "pyu2f dependency is required to use Security key reauth feature. "
diff --git a/google/oauth2/py.typed b/google/oauth2/py.typed
new file mode 100644
index 000000000..d82ed62c2
--- /dev/null
+++ b/google/oauth2/py.typed
@@ -0,0 +1,2 @@
+# Marker file for PEP 561.
+# The google-oauth2 package uses inline types.
diff --git a/google/oauth2/service_account.py b/google/oauth2/service_account.py
index ecaac038c..5c4f340fa 100644
--- a/google/oauth2/service_account.py
+++ b/google/oauth2/service_account.py
@@ -444,12 +444,12 @@ def _create_self_signed_jwt(self, audience):
     def sign_bytes(self, message):
         return self._signer.sign(message)
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(credentials.Signing)
     def signer(self):
         return self._signer
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(credentials.Signing)
     def signer_email(self):
         return self._service_account_email
@@ -676,12 +676,12 @@ def service_account_email(self):
     def sign_bytes(self, message):
         return self._signer.sign(message)
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(credentials.Signing)
     def signer(self):
         return self._signer
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(credentials.Signing)
     def signer_email(self):
         return self._service_account_email
diff --git a/mypy.ini b/mypy.ini
new file mode 100644
index 000000000..4505b4854
--- /dev/null
+++ b/mypy.ini
@@ -0,0 +1,3 @@
+[mypy]
+python_version = 3.6
+namespace_packages = True
diff --git a/noxfile.py b/noxfile.py
index 8c22b7a77..1032be641 100644
--- a/noxfile.py
+++ b/noxfile.py
@@ -62,6 +62,24 @@ def blacken(session):
     session.run("black", *BLACK_PATHS)
 
 
+@nox.session(python="3.6")
+def mypy(session):
+    """Verify type hints are mypy compatible."""
+    session.install("-e", ".")
+    session.install(
+        "mypy",
+        "types-cachetools",
+        "types-certifi",
+        "types-freezegun",
+        "types-pyOpenSSL",
+        "types-requests",
+        "types-setuptools",
+        "types-six",
+        "types-mock",
+    )
+    session.run("mypy", "google/", "tests/", "tests_async/")
+
+
 @nox.session(python=["3.6", "3.7", "3.8", "3.9", "3.10"])
 def unit(session):
     constraints_path = str(
diff --git a/tests/compute_engine/test__metadata.py b/tests/compute_engine/test__metadata.py
index 852822dc0..568812056 100644
--- a/tests/compute_engine/test__metadata.py
+++ b/tests/compute_engine/test__metadata.py
@@ -17,7 +17,7 @@
 import os
 
 import mock
-import pytest
+import pytest  # type: ignore
 from six.moves import http_client
 from six.moves import reload_module
 
diff --git a/tests/compute_engine/test_credentials.py b/tests/compute_engine/test_credentials.py
index 81cc6db31..ff01720c4 100644
--- a/tests/compute_engine/test_credentials.py
+++ b/tests/compute_engine/test_credentials.py
@@ -15,8 +15,8 @@
 import datetime
 
 import mock
-import pytest
-import responses
+import pytest  # type: ignore
+import responses  # type: ignore
 
 from google.auth import _helpers
 from google.auth import exceptions
diff --git a/tests/conftest.py b/tests/conftest.py
index cf8a0f9e5..8080ec3fa 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -16,7 +16,7 @@
 import sys
 
 import mock
-import pytest
+import pytest  # type: ignore
 
 
 def pytest_configure():
diff --git a/tests/crypt/test__cryptography_rsa.py b/tests/crypt/test__cryptography_rsa.py
index dbf07c780..99d8fc37c 100644
--- a/tests/crypt/test__cryptography_rsa.py
+++ b/tests/crypt/test__cryptography_rsa.py
@@ -16,7 +16,7 @@
 import os
 
 from cryptography.hazmat.primitives.asymmetric import rsa
-import pytest
+import pytest  # type: ignore
 
 from google.auth import _helpers
 from google.auth.crypt import _cryptography_rsa
@@ -55,7 +55,7 @@
 # The service account JSON file can be generated from the Google Cloud Console.
 SERVICE_ACCOUNT_JSON_FILE = os.path.join(DATA_DIR, "service_account.json")
 
-with open(SERVICE_ACCOUNT_JSON_FILE, "r") as fh:
+with open(SERVICE_ACCOUNT_JSON_FILE, "rb") as fh:
     SERVICE_ACCOUNT_INFO = json.load(fh)
 
 
diff --git a/tests/crypt/test__python_rsa.py b/tests/crypt/test__python_rsa.py
index 886ee55a2..9d832f044 100644
--- a/tests/crypt/test__python_rsa.py
+++ b/tests/crypt/test__python_rsa.py
@@ -16,9 +16,9 @@
 import os
 
 import mock
-from pyasn1_modules import pem
-import pytest
-import rsa
+from pyasn1_modules import pem  # type: ignore
+import pytest  # type: ignore
+import rsa  # type: ignore
 import six
 
 from google.auth import _helpers
@@ -58,7 +58,7 @@
 # The service account JSON file can be generated from the Google Cloud Console.
 SERVICE_ACCOUNT_JSON_FILE = os.path.join(DATA_DIR, "service_account.json")
 
-with open(SERVICE_ACCOUNT_JSON_FILE, "r") as fh:
+with open(SERVICE_ACCOUNT_JSON_FILE, "rb") as fh:
     SERVICE_ACCOUNT_INFO = json.load(fh)
 
 
diff --git a/tests/crypt/test_es256.py b/tests/crypt/test_es256.py
index 5bb9050cd..33465ce6d 100644
--- a/tests/crypt/test_es256.py
+++ b/tests/crypt/test_es256.py
@@ -17,7 +17,7 @@
 import os
 
 from cryptography.hazmat.primitives.asymmetric import ec
-import pytest
+import pytest  # type: ignore
 
 from google.auth import _helpers
 from google.auth.crypt import base
@@ -45,7 +45,7 @@
 
 SERVICE_ACCOUNT_JSON_FILE = os.path.join(DATA_DIR, "es256_service_account.json")
 
-with open(SERVICE_ACCOUNT_JSON_FILE, "r") as fh:
+with open(SERVICE_ACCOUNT_JSON_FILE, "rb") as fh:
     SERVICE_ACCOUNT_INFO = json.load(fh)
 
 
diff --git a/tests/oauth2/test__client.py b/tests/oauth2/test__client.py
index 54686df59..5485bed84 100644
--- a/tests/oauth2/test__client.py
+++ b/tests/oauth2/test__client.py
@@ -17,7 +17,7 @@
 import os
 
 import mock
-import pytest
+import pytest  # type: ignore
 import six
 from six.moves import http_client
 from six.moves import urllib
diff --git a/tests/oauth2/test_challenges.py b/tests/oauth2/test_challenges.py
index 412895ada..9e35d88af 100644
--- a/tests/oauth2/test_challenges.py
+++ b/tests/oauth2/test_challenges.py
@@ -18,8 +18,8 @@
 import sys
 
 import mock
-import pytest
-import pyu2f
+import pytest  # type: ignore
+import pyu2f  # type: ignore
 
 from google.auth import exceptions
 from google.oauth2 import challenges
diff --git a/tests/oauth2/test_credentials.py b/tests/oauth2/test_credentials.py
index 243f97de8..e5f71def0 100644
--- a/tests/oauth2/test_credentials.py
+++ b/tests/oauth2/test_credentials.py
@@ -19,7 +19,7 @@
 import sys
 
 import mock
-import pytest
+import pytest  # type: ignore
 
 from google.auth import _helpers
 from google.auth import exceptions
diff --git a/tests/oauth2/test_id_token.py b/tests/oauth2/test_id_token.py
index ccfaaaf8c..40204f9d4 100644
--- a/tests/oauth2/test_id_token.py
+++ b/tests/oauth2/test_id_token.py
@@ -16,7 +16,7 @@
 import os
 
 import mock
-import pytest
+import pytest  # type: ignore
 
 from google.auth import environment_vars
 from google.auth import exceptions
diff --git a/tests/oauth2/test_reauth.py b/tests/oauth2/test_reauth.py
index 58d649d83..ae64be009 100644
--- a/tests/oauth2/test_reauth.py
+++ b/tests/oauth2/test_reauth.py
@@ -15,7 +15,7 @@
 import copy
 
 import mock
-import pytest
+import pytest  # type: ignore
 
 from google.auth import exceptions
 from google.oauth2 import reauth
diff --git a/tests/oauth2/test_service_account.py b/tests/oauth2/test_service_account.py
index 531fc4c9e..1d1438485 100644
--- a/tests/oauth2/test_service_account.py
+++ b/tests/oauth2/test_service_account.py
@@ -38,7 +38,7 @@
 
 SERVICE_ACCOUNT_JSON_FILE = os.path.join(DATA_DIR, "service_account.json")
 
-with open(SERVICE_ACCOUNT_JSON_FILE, "r") as fh:
+with open(SERVICE_ACCOUNT_JSON_FILE, "rb") as fh:
     SERVICE_ACCOUNT_INFO = json.load(fh)
 
 SIGNER = crypt.RSASigner.from_string(PRIVATE_KEY_BYTES, "1")
diff --git a/tests/oauth2/test_sts.py b/tests/oauth2/test_sts.py
index e8e008df5..f61a1d338 100644
--- a/tests/oauth2/test_sts.py
+++ b/tests/oauth2/test_sts.py
@@ -15,7 +15,7 @@
 import json
 
 import mock
-import pytest
+import pytest  # type: ignore
 from six.moves import http_client
 from six.moves import urllib
 
diff --git a/tests/oauth2/test_utils.py b/tests/oauth2/test_utils.py
index 6de9ff533..543a693a9 100644
--- a/tests/oauth2/test_utils.py
+++ b/tests/oauth2/test_utils.py
@@ -14,7 +14,7 @@
 
 import json
 
-import pytest
+import pytest  # type: ignore
 
 from google.auth import exceptions
 from google.oauth2 import utils
diff --git a/tests/test__cloud_sdk.py b/tests/test__cloud_sdk.py
index 31cb6c22c..c05c44320 100644
--- a/tests/test__cloud_sdk.py
+++ b/tests/test__cloud_sdk.py
@@ -18,7 +18,7 @@
 import subprocess
 
 import mock
-import pytest
+import pytest  # type: ignore
 
 from google.auth import _cloud_sdk
 from google.auth import environment_vars
@@ -28,12 +28,12 @@
 DATA_DIR = os.path.join(os.path.dirname(__file__), "data")
 AUTHORIZED_USER_FILE = os.path.join(DATA_DIR, "authorized_user.json")
 
-with io.open(AUTHORIZED_USER_FILE) as fh:
+with io.open(AUTHORIZED_USER_FILE, "rb") as fh:
     AUTHORIZED_USER_FILE_DATA = json.load(fh)
 
 SERVICE_ACCOUNT_FILE = os.path.join(DATA_DIR, "service_account.json")
 
-with io.open(SERVICE_ACCOUNT_FILE) as fh:
+with io.open(SERVICE_ACCOUNT_FILE, "rb") as fh:
     SERVICE_ACCOUNT_FILE_DATA = json.load(fh)
 
 with io.open(os.path.join(DATA_DIR, "cloud_sdk_config.json"), "rb") as fh:
@@ -63,7 +63,7 @@ def test_get_project_id(data, expected_project_id):
 @mock.patch(
     "subprocess.check_output",
     autospec=True,
-    side_effect=subprocess.CalledProcessError(-1, None),
+    side_effect=subprocess.CalledProcessError(-1, "testing"),
 )
 def test_get_project_id_call_error(check_output):
     project_id = _cloud_sdk.get_project_id()
diff --git a/tests/test__default.py b/tests/test__default.py
index 1ce03cfe8..fe5710d3d 100644
--- a/tests/test__default.py
+++ b/tests/test__default.py
@@ -16,7 +16,7 @@
 import os
 
 import mock
-import pytest
+import pytest  # type: ignore
 
 from google.auth import _default
 from google.auth import app_engine
diff --git a/tests/test__helpers.py b/tests/test__helpers.py
index 0c0bad2d2..8c71f3e51 100644
--- a/tests/test__helpers.py
+++ b/tests/test__helpers.py
@@ -14,7 +14,7 @@
 
 import datetime
 
-import pytest
+import pytest  # type: ignore
 from six.moves import urllib
 
 from google.auth import _helpers
diff --git a/tests/test__oauth2client.py b/tests/test__oauth2client.py
index 6b1112b50..f1fac511b 100644
--- a/tests/test__oauth2client.py
+++ b/tests/test__oauth2client.py
@@ -17,10 +17,10 @@
 import sys
 
 import mock
-import oauth2client.client
-import oauth2client.contrib.gce
-import oauth2client.service_account
-import pytest
+import oauth2client.client  # type: ignore
+import oauth2client.contrib.gce  # type: ignore
+import oauth2client.service_account  # type: ignore
+import pytest  # type: ignore
 from six.moves import reload_module
 
 from google.auth import _oauth2client
@@ -109,7 +109,7 @@ def test__convert_appengine_app_assertion_credentials(
     app_identity, mock_oauth2client_gae_imports
 ):
 
-    import oauth2client.contrib.appengine
+    import oauth2client.contrib.appengine  # type: ignore
 
     service_account_id = "service_account_id"
     old_credentials = oauth2client.contrib.appengine.AppAssertionCredentials(
diff --git a/tests/test__service_account_info.py b/tests/test__service_account_info.py
index 13b2f85a2..d5529bcce 100644
--- a/tests/test__service_account_info.py
+++ b/tests/test__service_account_info.py
@@ -15,7 +15,7 @@
 import json
 import os
 
-import pytest
+import pytest  # type: ignore
 import six
 
 from google.auth import _service_account_info
diff --git a/tests/test_app_engine.py b/tests/test_app_engine.py
index 6a788b9e9..ca085bd69 100644
--- a/tests/test_app_engine.py
+++ b/tests/test_app_engine.py
@@ -15,7 +15,7 @@
 import datetime
 
 import mock
-import pytest
+import pytest  # type: ignore
 
 from google.auth import app_engine
 
diff --git a/tests/test_aws.py b/tests/test_aws.py
index 9ca08d5b2..d37131afb 100644
--- a/tests/test_aws.py
+++ b/tests/test_aws.py
@@ -16,7 +16,7 @@
 import json
 
 import mock
-import pytest
+import pytest  # type: ignore
 from six.moves import http_client
 from six.moves import urllib
 
diff --git a/tests/test_credentials.py b/tests/test_credentials.py
index 2de638840..da074143a 100644
--- a/tests/test_credentials.py
+++ b/tests/test_credentials.py
@@ -14,7 +14,7 @@
 
 import datetime
 
-import pytest
+import pytest  # type: ignore
 
 from google.auth import _helpers
 from google.auth import credentials
diff --git a/tests/test_downscoped.py b/tests/test_downscoped.py
index 9ca95f5aa..7d0768a18 100644
--- a/tests/test_downscoped.py
+++ b/tests/test_downscoped.py
@@ -16,7 +16,7 @@
 import json
 
 import mock
-import pytest
+import pytest  # type: ignore
 from six.moves import http_client
 from six.moves import urllib
 
diff --git a/tests/test_external_account.py b/tests/test_external_account.py
index 3c34f998c..3897aef15 100644
--- a/tests/test_external_account.py
+++ b/tests/test_external_account.py
@@ -16,7 +16,7 @@
 import json
 
 import mock
-import pytest
+import pytest  # type: ignore
 from six.moves import http_client
 from six.moves import urllib
 
diff --git a/tests/test_iam.py b/tests/test_iam.py
index bc71225b1..ae482765b 100644
--- a/tests/test_iam.py
+++ b/tests/test_iam.py
@@ -17,7 +17,7 @@
 import json
 
 import mock
-import pytest
+import pytest  # type: ignore
 from six.moves import http_client
 
 from google.auth import _helpers
diff --git a/tests/test_identity_pool.py b/tests/test_identity_pool.py
index 87e343be4..664c317d0 100644
--- a/tests/test_identity_pool.py
+++ b/tests/test_identity_pool.py
@@ -17,7 +17,7 @@
 import os
 
 import mock
-import pytest
+import pytest  # type: ignore
 from six.moves import http_client
 from six.moves import urllib
 
diff --git a/tests/test_impersonated_credentials.py b/tests/test_impersonated_credentials.py
index bc404e36b..58d159a59 100644
--- a/tests/test_impersonated_credentials.py
+++ b/tests/test_impersonated_credentials.py
@@ -16,8 +16,11 @@
 import json
 import os
 
+# Because Python 2.7
+# from typing import List
+
 import mock
-import pytest
+import pytest  # type: ignore
 from six.moves import http_client
 
 from google.auth import _helpers
@@ -46,7 +49,7 @@
 )
 ID_TOKEN_EXPIRY = 1564475051
 
-with open(SERVICE_ACCOUNT_JSON_FILE, "r") as fh:
+with open(SERVICE_ACCOUNT_JSON_FILE, "rb") as fh:
     SERVICE_ACCOUNT_INFO = json.load(fh)
 
 SIGNER = crypt.RSASigner.from_string(PRIVATE_KEY_BYTES, "1")
@@ -98,7 +101,9 @@ class TestImpersonatedCredentials(object):
     SERVICE_ACCOUNT_EMAIL = "service-account@example.com"
     TARGET_PRINCIPAL = "impersonated@project.iam.gserviceaccount.com"
     TARGET_SCOPES = ["https://www.googleapis.com/auth/devstorage.read_only"]
-    DELEGATES = []
+    # DELEGATES: List[str] = []
+    # Because Python 2.7:
+    DELEGATES = []  # type: ignore
     LIFETIME = 3600
     SOURCE_CREDENTIALS = service_account.Credentials(
         SIGNER, SERVICE_ACCOUNT_EMAIL, TOKEN_URI
diff --git a/tests/test_jwt.py b/tests/test_jwt.py
index c0e1184dc..bc01ebfc7 100644
--- a/tests/test_jwt.py
+++ b/tests/test_jwt.py
@@ -18,7 +18,7 @@
 import os
 
 import mock
-import pytest
+import pytest  # type: ignore
 
 from google.auth import _helpers
 from google.auth import crypt
@@ -45,7 +45,7 @@
 
 SERVICE_ACCOUNT_JSON_FILE = os.path.join(DATA_DIR, "service_account.json")
 
-with open(SERVICE_ACCOUNT_JSON_FILE, "r") as fh:
+with open(SERVICE_ACCOUNT_JSON_FILE, "rb") as fh:
     SERVICE_ACCOUNT_INFO = json.load(fh)
 
 
diff --git a/tests/transport/compliance.py b/tests/transport/compliance.py
index e093d761d..faf39b9ba 100644
--- a/tests/transport/compliance.py
+++ b/tests/transport/compliance.py
@@ -14,9 +14,9 @@
 
 import time
 
-import flask
-import pytest
-from pytest_localserver.http import WSGIServer
+import flask  # type: ignore
+import pytest  # type: ignore
+from pytest_localserver.http import WSGIServer  # type: ignore
 from six.moves import http_client
 
 from google.auth import exceptions
diff --git a/tests/transport/test__http_client.py b/tests/transport/test__http_client.py
index c176cb2f4..202276323 100644
--- a/tests/transport/test__http_client.py
+++ b/tests/transport/test__http_client.py
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-import pytest
+import pytest  # type: ignore
 
 from google.auth import exceptions
 import google.auth.transport._http_client
diff --git a/tests/transport/test__mtls_helper.py b/tests/transport/test__mtls_helper.py
index 3b6349a1d..1621a0530 100644
--- a/tests/transport/test__mtls_helper.py
+++ b/tests/transport/test__mtls_helper.py
@@ -17,15 +17,13 @@
 
 import mock
 from OpenSSL import crypto
-import pytest
+import pytest  # type: ignore
 
 from google.auth import exceptions
 from google.auth.transport import _mtls_helper
 
 CONTEXT_AWARE_METADATA = {"cert_provider_command": ["some command"]}
 
-CONTEXT_AWARE_METADATA_NO_CERT_PROVIDER_COMMAND = {}
-
 ENCRYPTED_EC_PRIVATE_KEY = b"""-----BEGIN ENCRYPTED PRIVATE KEY-----
 MIHkME8GCSqGSIb3DQEFDTBCMCkGCSqGSIb3DQEFDDAcBAgl2/yVgs1h3QICCAAw
 DAYIKoZIhvcNAgkFADAVBgkrBgEEAZdVAQIECJk2GRrvxOaJBIGQXIBnMU4wmciT
diff --git a/tests/transport/test_grpc.py b/tests/transport/test_grpc.py
index 3437658a3..f62ab0eae 100644
--- a/tests/transport/test_grpc.py
+++ b/tests/transport/test_grpc.py
@@ -17,7 +17,7 @@
 import time
 
 import mock
-import pytest
+import pytest  # type: ignore
 
 from google.auth import _helpers
 from google.auth import credentials
@@ -28,7 +28,7 @@
 
 try:
     # pylint: disable=ungrouped-imports
-    import grpc
+    import grpc  # type: ignore
     import google.auth.transport.grpc
 
     HAS_GRPC = True
diff --git a/tests/transport/test_mtls.py b/tests/transport/test_mtls.py
index ff70bb3c2..b62063e47 100644
--- a/tests/transport/test_mtls.py
+++ b/tests/transport/test_mtls.py
@@ -13,7 +13,7 @@
 # limitations under the License.
 
 import mock
-import pytest
+import pytest  # type: ignore
 
 from google.auth import exceptions
 from google.auth.transport import mtls
diff --git a/tests/transport/test_requests.py b/tests/transport/test_requests.py
index ed9300d76..60d44a5f4 100644
--- a/tests/transport/test_requests.py
+++ b/tests/transport/test_requests.py
@@ -20,7 +20,7 @@
 import freezegun
 import mock
 import OpenSSL
-import pytest
+import pytest  # type: ignore
 import requests
 import requests.adapters
 from six.moves import http_client
diff --git a/tests/transport/test_urllib3.py b/tests/transport/test_urllib3.py
index e3848c177..396961c39 100644
--- a/tests/transport/test_urllib3.py
+++ b/tests/transport/test_urllib3.py
@@ -17,9 +17,9 @@
 
 import mock
 import OpenSSL
-import pytest
+import pytest  # type: ignore
 from six.moves import http_client
-import urllib3
+import urllib3  # type: ignore
 
 from google.auth import environment_vars
 from google.auth import exceptions
diff --git a/tests_async/conftest.py b/tests_async/conftest.py
index b4e90f0e8..f13dec0e4 100644
--- a/tests_async/conftest.py
+++ b/tests_async/conftest.py
@@ -16,7 +16,7 @@
 import sys
 
 import mock
-import pytest
+import pytest  # type: ignore
 
 
 def pytest_configure():
diff --git a/tests_async/oauth2/test__client_async.py b/tests_async/oauth2/test__client_async.py
index 6e48c4590..91874cdd4 100644
--- a/tests_async/oauth2/test__client_async.py
+++ b/tests_async/oauth2/test__client_async.py
@@ -16,7 +16,7 @@
 import json
 
 import mock
-import pytest
+import pytest  # type: ignore
 import six
 from six.moves import http_client
 from six.moves import urllib
diff --git a/tests_async/oauth2/test_credentials_async.py b/tests_async/oauth2/test_credentials_async.py
index 06c91419c..a328cc3cb 100644
--- a/tests_async/oauth2/test_credentials_async.py
+++ b/tests_async/oauth2/test_credentials_async.py
@@ -19,7 +19,7 @@
 import sys
 
 import mock
-import pytest
+import pytest  # type: ignore
 
 from google.auth import _helpers
 from google.auth import exceptions
diff --git a/tests_async/oauth2/test_id_token.py b/tests_async/oauth2/test_id_token.py
index 2aee7676b..b84e74db2 100644
--- a/tests_async/oauth2/test_id_token.py
+++ b/tests_async/oauth2/test_id_token.py
@@ -15,7 +15,7 @@
 import os
 
 import mock
-import pytest
+import pytest  # type: ignore
 
 from google.auth import environment_vars
 from google.auth import exceptions
diff --git a/tests_async/oauth2/test_reauth_async.py b/tests_async/oauth2/test_reauth_async.py
index d982e13a1..8f51bd3a7 100644
--- a/tests_async/oauth2/test_reauth_async.py
+++ b/tests_async/oauth2/test_reauth_async.py
@@ -15,7 +15,7 @@
 import copy
 
 import mock
-import pytest
+import pytest  # type: ignore
 
 from google.auth import exceptions
 from google.oauth2 import _reauth_async
diff --git a/tests_async/oauth2/test_service_account_async.py b/tests_async/oauth2/test_service_account_async.py
index 3dce13d82..176992f77 100644
--- a/tests_async/oauth2/test_service_account_async.py
+++ b/tests_async/oauth2/test_service_account_async.py
@@ -15,7 +15,7 @@
 import datetime
 
 import mock
-import pytest
+import pytest  # type: ignore
 
 from google.auth import _helpers
 from google.auth import crypt
diff --git a/tests_async/test__default_async.py b/tests_async/test__default_async.py
index 69a50d69a..bf1a129a8 100644
--- a/tests_async/test__default_async.py
+++ b/tests_async/test__default_async.py
@@ -16,7 +16,7 @@
 import os
 
 import mock
-import pytest
+import pytest  # type: ignore
 
 from google.auth import _credentials_async as credentials
 from google.auth import _default_async as _default
diff --git a/tests_async/test_credentials_async.py b/tests_async/test_credentials_async.py
index 5315483da..9db5fc9ae 100644
--- a/tests_async/test_credentials_async.py
+++ b/tests_async/test_credentials_async.py
@@ -14,7 +14,7 @@
 
 import datetime
 
-import pytest
+import pytest  # type: ignore
 
 from google.auth import _credentials_async as credentials
 from google.auth import _helpers
diff --git a/tests_async/test_jwt_async.py b/tests_async/test_jwt_async.py
index a35b837b7..f24a0a99d 100644
--- a/tests_async/test_jwt_async.py
+++ b/tests_async/test_jwt_async.py
@@ -16,7 +16,7 @@
 import json
 
 import mock
-import pytest
+import pytest  # type: ignore
 
 from google.auth import _jwt_async as jwt_async
 from google.auth import crypt
diff --git a/tests_async/transport/async_compliance.py b/tests_async/transport/async_compliance.py
index 9c4b173c2..36fe7a301 100644
--- a/tests_async/transport/async_compliance.py
+++ b/tests_async/transport/async_compliance.py
@@ -14,9 +14,9 @@
 
 import time
 
-import flask
-import pytest
-from pytest_localserver.http import WSGIServer
+import flask  # type: ignore
+import pytest  # type: ignore
+from pytest_localserver.http import WSGIServer  # type: ignore
 from six.moves import http_client
 
 from google.auth import exceptions
diff --git a/tests_async/transport/test_aiohttp_requests.py b/tests_async/transport/test_aiohttp_requests.py
index a64a4eec9..d00955a7d 100644
--- a/tests_async/transport/test_aiohttp_requests.py
+++ b/tests_async/transport/test_aiohttp_requests.py
@@ -12,10 +12,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-import aiohttp
-from aioresponses import aioresponses, core
+import aiohttp  # type: ignore
+from aioresponses import aioresponses, core  # type: ignore
 import mock
-import pytest
+import pytest  # type: ignore
 from tests_async.transport import async_compliance
 
 import google.auth._credentials_async