Install Python packages

Sign in once, then let rvs select the repository URL and provide temporary authentication to the Python client.

Install with pip through rvs

Avoid a token-bearing command line with rvs. After rvs auth login, select the private repository once:

rvs art select platform/releases
rvs pip install internal-sdk

Installation is delegated to pip with authentication limited to the child process.

Install with uv

Use the same repository target with the uv wrapper:

rvs art select platform/releases
rvs uv pip install internal-sdk

For a uv project, sync its locked dependencies through the same target:

rvs art select platform/releases
rvs uv sync --locked

rvs keeps the Ravenstash URL and credential out of committed project configuration.

Choose index behavior carefully

If a private mirror is connected, eligible public dependencies resolve through the same selected Ravenstash target. One protected source avoids the ambiguous multi-index behavior that can lead to dependency-confusion attacks.

A private package name takes priority over the same name on PyPI. To reserve names you have not published yet, such as acme-*, add a package resolution rule.

Verify the source

Use verbose client output when troubleshooting:

rvs art select platform/releases
rvs pip install --verbose internal-sdk==1.2.3

The downloaded file URL should use pypi.rvsta.sh.

rvs obtains the repository URL from the selected target and limits authentication to the command it launches.

Use pip or uv directly

For pip install, uv sync, or uv pip install without a wrapper, mint a short-lived read token for the repository:

RVS_NATIVE_TOKEN=$(rvs art token mint \
  --target platform/releases \
  --format pypi \
  --access read)
export RVS_NATIVE_TOKEN

Copy the current download address from Ravenstash. The examples below use:

https://pypi.rvsta.sh/platform/releases/simple/

Print the current addresses or generate a complete target-specific recipe:

rvs art endpoint --target platform/releases --format pypi
rvs art native config pip --target platform/releases
rvs art native config uv --target platform/releases --access read

endpoint only prints addresses. native config prints configuration and commands without writing files, minting a token, or running the package tool.

pip

Set the private index in pip.conf:

pip.conf

[global]
index-url = https://pypi.rvsta.sh/platform/releases/simple/

Give pip the token through a private temporary netrc file:

RVS_NETRC=$(mktemp)
chmod 600 "$RVS_NETRC"
printf 'machine pypi.rvsta.sh login rvs password %s' \
  "$RVS_NATIVE_TOKEN" > "$RVS_NETRC"
export NETRC="$RVS_NETRC"

pip install your-package

rm -- "$RVS_NETRC"
unset NETRC RVS_NATIVE_TOKEN

uv

Add the index to pyproject.toml:

pyproject.toml

[[tool.uv.index]]
name = "ravenstash"
url = "https://pypi.rvsta.sh/platform/releases/simple/"
default = true
authenticate = "always"

uv derives its credential-variable names from the index name:

export UV_INDEX_RAVENSTASH_USERNAME=rvs
export UV_INDEX_RAVENSTASH_PASSWORD="$RVS_NATIVE_TOKEN"

uv sync
uv pip install your-package

Keep the token out of configuration, logs, and shell history. See Use tokens with package tools for expiry, access, and rotation details.