At work we use a private pypi server. This pypi server is specified as a dependency link:

from setuptools import setup

config = ConfigParser.ConfigParser()
rc = os.path.join(os.path.expanduser('~'), '.pypirc')
dependency_links = [
        config.get('dc', 'username'), config.get('dc', 'password'))]


This works fine in most of our cases. However, some time ago we had to install packages on a client server. For this we had to copy over a valid .pypirc before we could install any packages.

Also the code above just feels like a dirty hack.

What is the proper way to specify secured dependency links without hardcoding credentials?

  • 1
    I see what you mean. It's not that dirty of a hack, but it means you're coupling authentication with dependency management on a per-package basis. This approach is not portable or scalable. Commented Feb 23, 2017 at 17:52

3 Answers 3


This seems like a reasonable and not a dirty hack at all.

  1. There is a configuration file for credentials
  2. There is a way to inject the custom URL + creds into the dependencies

The job is being done and being done well, the only way to make this better is to document it and try it out on multiple different setups or with multiple pypi servers and address issues that come out of that.


Be very careful to when using this solution. As stated in the documentation:

They will also be written into the egg’s metadata for use by tools like EasyInstall to use when installing an .egg file.

I.e., your credentials will be distributed in the .egg. By rooting through the setuptools source code, I found out that internally it seems to be using the easy_install command to install dependencies. Therefore, adding the following to your setup.cfg causes it to pick up a private repo:

index_url=https://username:[email protected]/simple

This still has the snafu that your credentials get printed to the terminal when it's installing it, but at least they do not end up in your distribution. Note that this solution replaces your index URL, so your private repo also has to mirror the public one. I did not see support for adding index URLs in any obvious way.


One possibility would be setting Environment Variables. This could be done with deployment tools like Ansible. Storing your secrets with Stack Overflow's Blackbox or Ansible's Vault

Alternatively: Containerization would help, since everything needed to run the software is built in.

Not the answer you're looking for? Browse other questions tagged or ask your own question.