Understanding the .pypirc Configuration File
The .pypirc file is a configuration file used by Python packaging tools to store information about Package Index repositories, primarily the Python Package Index (PyPI). It allows developers to automate the authentication process when uploading packages using tools like Twine or Flit.
File Structure and Location
Typically located in the user's home directory (~/.pypirc on Unix-like systems or %USERPROFILE%\.pypirc on Windows), the file follows the INI format. It is divided into sections, starting with a [distutils] header that lists the defined repository names.
A standard configuration includes a repository URL, a username, and a password. For enhanced security, the PyPI maintainers strongly recommend using API Tokens instead of account passwords. When using a token, the username should be set to __token__ and the password to the token value itself, including the pypi- prefix.
Example Configuration
A basic .pypirc might look like this:
[distutils]
index-servers =
pypi
testpypi
[pypi]
repository = https://upload.pypi.org/legacy/
username = __token__
password = pypi-AgEIcHlwaS5vcmc...Security Considerations
Because the .pypirc file contains sensitive credentials, it is crucial to set appropriate file permissions. On Linux and macOS, it is recommended to restrict access to the file using chmod 600 ~/.pypirc. More information on secure distribution can be found in the official Python Packaging User Guide.