def create_auth_header(username, key=None, key_file="~/.ssh/id_rsa", key_password=None):
    """
    Create an HTTP Authorization header using a private key file.

    Either a key or a key_file must be provided.

    :param username: The username to authenticate as on the remote system.
    :param key: Optional. A private key as either a string or an instance of cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey.
    :param key_file: Optional. Path to a file containing the user's private key. Defaults to ~/.ssh/id_rsa. Should be in PEM format.
    :param key_password: Optional. Password to decrypt key_file. If set, should be a bytes object.
    :return: Authentication header value as a string.
    """
    if not key:
        key = load_private_key(key_file, key_password)
    claim = token.sign(username, key)
    return "%s %s" % (AUTH_METHOD, claim.decode(ENCODING))