Azure Artifacts · Python · Checked November 6, 2026

Azure Artifacts: pip "401 Error, Credentials not correct for …/pypi/simple/"

pip asks the feed's index (…/_packaging/<feed>/pypi/simple/<package>/) which versions exist. Azure Artifacts answers 401 to a request without a credential it accepts. pip does not stop there: it prints a warning, treats the feed as having nothing, and then fails with (from versions: none). That reads like the package is not on the feed, but the feed was never read (a Stack Overflow question on it has been seen over 40,000 times).

When pip install fails in a pull request's build validation, the pull request waits on it: Azure DevOps Pull Requests, a plugin for JetBrains IDEs, lists the pull request's branch policies with their state in your IDE, and with Pro runs a failed build policy again once the feed lets the build in. Get it on JetBrains Marketplace

What it looks like

• WARNING: 401 Error, Credentials not correct for https://pkgs.dev.azure.com/fabrikam/_packaging/shared/pypi/simple/fabrikam-tools/, then ERROR: Could not find a version that satisfies the requirement fabrikam-tools (from versions: none) and ERROR: No matching distribution found for fabrikam-tools.
• In a terminal, pip may instead ask User for pkgs.dev.azure.com:. It got the same 401 and has nothing else to try.
• The same happens on Azure DevOps Server, with the server's own address instead of pkgs.dev.azure.com.

On your machine: artifacts-keyring

• pip install artifacts-keyring adds a keyring backend that gets a token for Azure Artifacts feeds when pip asks; after that, pip install fabrikam-tools --index-url https://pkgs.dev.azure.com/fabrikam/_packaging/shared/pypi/simple/ works, or the same address as index-url in the pip.ini (Windows) or pip.conf (macOS, Linux) of your virtual environment, as Microsoft's quickstart sets it up.
• It needs pip 19.2 or later and Python 3.10 or later, and on Linux a .NET 8 runtime (its README). Answers on the most read question come down to this: install artifacts-keyring, and upgrade pip first with python -m pip install --upgrade pip.
• The first time, it signs you in, for example with a device code shown in the terminal. If nothing is shown, its verbosity may be set to Warning or higher, which hides those prompts; the README lists ARTIFACTS_KEYRING_VERBOSITY for this.

Without artifacts-keyring: a personal access token

• Create a personal access token with the Packaging, Read scope, and use it as the password (the accepted answer on the question with this warning). In the index URL: https://any-name:<token>@pkgs.dev.azure.com/fabrikam/_packaging/shared/pypi/simple/. The user name is not checked; it only has to be there.
• A token in a URL ends up in pip.conf or in shell history. Keep that file out of the repository, and make a new token when it expires: the 401 comes back on the day it does.
• For a project-scoped feed, the project is part of the address: …/fabrikam/Web/_packaging/shared/pypi/simple/.

In a pipeline: PipAuthenticate before pip install

• Add - task: PipAuthenticate@1 with artifactFeeds: before any pip install. It sets PIP_INDEX_URL and PIP_EXTRA_INDEX_URL with credentials for those feeds (the task's reference). A project-scoped feed is written as project/feed, an organization-scoped one by its name. Feeds in other organizations go in pythonDownloadServiceConnections.
• Running the task again does not add to the first run: each run erases the credentials stored before. Put every feed the job needs in one task.
• With onlyAddExtraIndex: true, PyPI stays the main index and your feeds are only extra ones.
• With the task in place and still 401 or 403, the build identity has no role on the feed, or the feed is in another project. The roles and the scope setting are the same as for NuGet: Unable to load the service index for source. To save packages from an upstream source such as PyPI, the identity needs Feed and Upstream Reader (Collaborator), as the task's reference says.

Poetry

• Poetry does not read PIP_INDEX_URL, so PipAuthenticate alone does not help it. Give it the credentials for its source in a script step: poetry config http-basic.azure any-name $(System.AccessToken) before poetry install, where azure is the source's name in pyproject.toml (answers on a question about it). The job's token works only if the build identity has a role on the feed.

Azure DevOps pull requests in IntelliJ IDEA and Rider

Azure DevOps Pull Requests, a plugin by Lesstep for JetBrains IDEs 2024.1 or later and Android Studio, reads the organization, project and repository from your git remote and lists the pull requests that wait for your review in an IDE tool window, on Azure DevOps Services and on Azure DevOps Server. It shows the branch policies of a pull request with their state, so a required build that has not passed is next to its pull request, and with Pro you run a failed or expired build policy again from there. The review inbox is free; voting, commenting, completing and creating are Pro, with a 30-day trial.

Get it on JetBrains Marketplace

Azure DevOps, Azure Artifacts and Azure Pipelines are trademarks of Microsoft Corporation; Python and PyPI are trademarks of the Python Software Foundation; IntelliJ IDEA and Rider are trademarks of JetBrains s.r.o. This page is not affiliated with or endorsed by Microsoft, the Python Software Foundation or JetBrains.

More: Maven: 401 Unauthorized from a feed · NuGet: Unable to load the service index for source · npm: E401 Unable to authenticate · checkout stops with Git fetch failed with exit code: 128 · 日本語