Registry / aws / keyrings-codeartifact

keyrings-codeartifact

library2.1.2pypypi✓ verified 23d ago

The `keyrings.codeartifact` package provides automatic authentication for publishing and consuming Python packages within private PyPI repositories hosted on AWS CodeArtifact. It extends the `keyring` library to automatically inject time-limited access tokens, integrating seamlessly with tools like `pip`, `twine`, `uv`, and `pixi`. It is currently at version 2.1.2 and is actively maintained.

aws

pip install keyrings-codeartifact

github ↗package ↗

INSTALL

IMPORT

SIG · KEYRINGS-CODEARTIF

keyrings-codeartifact

awspythonv2.1.2

Install

5.4s avg

Import

738ms

Disk

69MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v2.1.2 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.776s · 71MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 5.4s · import 0.700s · 71MB

69MB installed

● package 69MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

keyrings.codeartifact

✓ import keyrings.codeartifact

While `keyrings.codeartifact` is an importable module, its primary function is to register itself as a backend for the `keyring` library upon installation. Users typically do not directly import classes or functions from `keyrings.codeartifact` for its core credential-providing functionality; rather, `pip`, `twine`, `uv`, or `pixi` implicitly utilize it via the `keyring` abstraction.

This quickstart demonstrates how to set up `keyrings-codeartifact` for use with `pip`. The library integrates automatically once installed, provided your AWS CLI credentials are configured. Users interact with their package manager (`pip`, `twine`, `uv`, `pixi`) normally, and `keyrings.codeartifact` transparently supplies the necessary tokens.

# 1. Install the keyrings-codeartifact package # pip install keyrings-codeartifact # 2. Ensure your AWS CLI is configured with appropriate credentials. # For example, through ~/.aws/credentials or environment variables (AWS_ACCESS_KEY_ID, etc.). # You can verify with: aws sts get-caller-identity # 3. Configure pip to use your AWS CodeArtifact repository. # Replace <DOMAIN>, <ACCOUNT_ID>, <REGION>, <REPOSITORY> with your CodeArtifact details. # The 'aws' username is required by CodeArtifact for token-based authentication. CODEARTIFACT_INDEX_URL = "https://<DOMAIN>-<ACCOUNT_ID>.d.codeartifact.<REGION>.amazonaws.com/pypi/<REPOSITORY>/simple/" # Example of how pip would implicitly use the keyring backend: # Assuming 'my-private-package' is in your CodeArtifact repository # and `keyrings-codeartifact` is installed and AWS credentials are set up. # This command would use the credential provided by keyrings.codeartifact automatically. # pip install my-private-package --index-url $CODEARTIFACT_INDEX_URL # To demonstrate that it doesn't break standard pip operations, you can try installing a public package: # pip install requests

Debug

Known issues

gotchaThe `keyrings.codeartifact` package functions as a backend for the `keyring` library. Its core utility is in automatically providing credentials to `pip`, `twine`, `uv`, or `pixi` without direct Python API calls by the user. Users typically do not import and use `keyrings.codeartifact` directly.

fix

Ensure `keyrings-codeartifact` is installed in the environment where your package manager (pip, twine, etc.) is run. Configure your package manager to point to the CodeArtifact repository URL.

affects: All versions

gotchaCodeArtifact authorization tokens are temporary and expire (defaulting to 12 hours). `keyrings.codeartifact` is designed to refresh these tokens automatically. If you encounter authentication failures, ensure your underlying AWS credentials (e.g., in `~/.aws/credentials`) are valid and have permissions to `codeartifact:GetAuthorizationToken`.

fix

Verify your AWS CLI configuration (`aws sts get-caller-identity`). If issues persist, running `keyring diagnose` can help identify problems with the keyring setup or location of the `keyringrc.cfg` file.

affects: All versions

gotchaWhen using `uv` or `pipx`, `keyring` and `keyrings.codeartifact` often need to be installed in the same environment (or globally if `uv` is configured for subprocess mode) for `keyring` to properly discover and utilize the CodeArtifact backend. Installing them in separate isolated environments might prevent `keyring` from functioning correctly.

fix

For `uv`, use `uv tool install keyring --with keyrings.codeartifact`. For `pipx`, use `pipx install keyring` and then `pipx inject keyring keyrings.codeartifact` to ensure they share the same virtual environment.

affects: All versions

gotchaCustom configuration options (e.g., `profile_name`, `token_duration`, explicit `aws_access_key_id`/`aws_secret_access_key`) for `keyrings.codeartifact` are managed via the `keyringrc.cfg` file. The location of this file can vary by platform. Incorrectly configured options can lead to authentication failures.

fix

Run `keyring diagnose` to find the exact location of `keyringrc.cfg` on your system. Refer to the `keyrings.codeartifact` documentation for available options and their correct syntax within the `[codeartifact]` section.

affects: All versions

gotchaOn Windows, some users have reported issues with `keyring` backends (which `keyrings.codeartifact` utilizes) related to character limits for tokens stored in the credential manager. This can lead to authentication failures for very long tokens.

fix

If encountering issues specifically on Windows, consider setting `poetry config keyring.enabled false` if using Poetry, or exploring alternatives if a token character limit is suspected to be the root cause. This is a rare edge case, but worth noting.

affects: All versions

Errors

Common errors & fixes

ERROR: Could not find a version that satisfies the requirement <package-name>

This generic pip error often occurs with CodeArtifact when `keyrings.codeartifact` fails to provide valid authentication to the private AWS CodeArtifact repository, or the repository URL is incorrect, preventing pip from discovering the package.

fix

Ensure your AWS CLI is configured and authenticated, your CodeArtifact repository URL is correctly set in `~/.config/pip/pip.conf` (or `pyproject.toml` for `uv`/`pdm`), and `keyrings.codeartifact` is properly installed. You may need to run `aws codeartifact login --tool pip --domain <DOMAIN> --domain-owner <ACCOUNT_ID> --repository <REPOSITORY>` to refresh your token and configure pip.

RuntimeError: No recommended backend was available. Install a recommended 3rd party backend package; or, install the keyrings.alt package if you want to use the non-recommended backends. See https://pypi.org/project/keyring for details.

The underlying `keyring` library, which `keyrings.codeartifact` extends, could not find a suitable system-level backend (like macOS Keychain, GNOME Keyring, or Windows Credential Manager) to securely store credentials, thus preventing `keyrings.codeartifact` from functioning.

fix

Install a suitable keyring backend for your operating system. For Linux, ensure a desktop keyring service like GNOME Keyring or KDE Wallet is running. On macOS, verify Keychain Access permissions. Alternatively, you can install `keyrings.alt` (e.g., `pip install keyrings.alt`) for alternative backend implementations, although some might have security implications.

401 Unauthorized

This indicates that the authentication token `keyrings.codeartifact` provided to CodeArtifact was expired or invalid, or the AWS credentials used to generate the token lack the necessary permissions.

fix

Refresh your AWS CodeArtifact authentication token by running `aws codeartifact login --tool pip --domain <DOMAIN> --domain-owner <ACCOUNT_ID> --repository <REPOSITORY>`. Verify that your AWS credentials are valid and the IAM user/role has `codeartifact:GetAuthorizationToken` permissions.

pipx install keyrings.codeartifact (or similar for isolated environments leading to keyring not working)

When using `pipx` or other isolated environment tools, `keyrings.codeartifact` must be installed in the same virtual environment as the `keyring` package itself, often by 'injecting' it, rather than in its own separate environment. Otherwise, `keyring` cannot discover and utilize the CodeArtifact backend.

fix

First install `keyring` globally via `pipx`, then inject `keyrings.codeartifact` into its environment: `pipx install keyring` followed by `pipx inject keyring keyrings.codeartifact`.

Upgrade

Version history

2.1.2latest on PyPI · released Jul 1, 2025

Audit

Dependencies

keyringrequiredThis package is an extension to the `keyring` library, which provides the underlying secure credential storage mechanism.

boto3requiredUsed to interact with AWS services, specifically to generate and retrieve CodeArtifact authorization tokens.

Agent activity

9 hits · last 30 days

node

Resources

githubhttps://github.com/jmkeyes/keyrings.codeartifact ↗

packagehttps://pypi.org/project/keyrings-codeartifact/ ↗