uv works with any package index that implements the Python Simple Repository API, so you have plenty of options for hosting private packages. This page compares seven of them against the same three criteria:
- Python standards that affect how uv resolves and installs packages
- Authentication: how uv logs in and how long credentials last
- Pricing model
The registries are listed alphabetically. “No” means the vendor doesn’t document support for the feature. Checked November 2026.
What the standards mean for uv
| Standard | What it does for uv |
|---|---|
| PEP 503 / PEP 691 | The HTML and JSON index pages uv reads to find files. Every index on this list serves PEP 503. |
| PEP 658 / PEP 714 | Lets uv read a wheel’s dependencies from a small metadata file instead of downloading the wheel. Resolution is faster, especially with large wheels. |
| PEP 592 | Yanked releases are skipped during resolution unless pinned exactly. |
| PEP 792 | Marks a project as archived or deprecated so installers can tell users. |
Summary
| Registry | PEP 503 | PEP 691 | PEP 658/714 | PEP 592 | PEP 792 | uv credential | Credential lifetime | Pricing model |
|---|---|---|---|---|---|---|---|---|
| AWS CodeArtifact | Yes | Yes | No | Upstream PyPI packages only | No | Authorization token | 15 minutes to 12 hours | Per GB stored + per request |
| Azure Artifacts | Yes | No | No | No | No | Personal access token | Up to 1 year | Per GiB stored, 2 GiB free |
| Cloudsmith | Yes | No | Yes | No | No | API key or entitlement token | No fixed expiry (OIDC: 2 hours) | Storage + delivery, free tier |
| GitLab | Yes | Yes (19.6; flag from 18.10) | No | No | No | Personal, deploy or CI job token | PAT up to 1 year; job token for the job | Per seat, free tier |
| Google Artifact Registry | Yes | No | No | No | No | OAuth access token or service account key | 1 hour (key: no expiry) | Per GB stored + egress |
| JFrog Artifactory | Yes | Yes | Opt-in | Yes | No | Access token | Configurable | Plan + consumption |
| RepoForge.io | Yes | Yes | Yes | Yes | Yes | Access token | Until revoked | Per user |
AWS CodeArtifact
- Standards: implements the Simple API per PEP 503, 691 and 700 (HTML and JSON), though only per-project pages exist, not the root
/simple/list. No PEP 658 metadata files. Theyankedfield is passed through for packages cached from PyPI, but you can’t yank packages you publish yourself. No PEP 792. - Authentication: username
awsand a token fromaws codeartifact get-authorization-tokenas the password, viaUV_INDEX_<NAME>_USERNAME/UV_INDEX_<NAME>_PASSWORD, orkeyringwith thekeyrings.codeartifactplugin to refresh it automatically. Tokens last 12 hours by default, configurable from 15 minutes to 12 hours, so CI and developer machines have to keep fetching new ones. - Pricing: pay as you go, no seats: $0.05/GB-month storage and $0.05 per 10,000 requests (us-east-1), plus standard AWS data transfer out. Small monthly free tier.
Azure Artifacts
- Standards: feeds serve a PEP 503 HTML index only; uv’s maintainers have asked Azure to add PEP 691/700. No metadata files, yanking or project status.
- Authentication: a personal access token (or
$(System.AccessToken)in Pipelines) as the password with any username, orkeyringwithartifacts-keyringfor Entra login. PATs last up to a year, and Microsoft now recommends Entra tokens instead. - Pricing: per organisation, no seats. First 2 GiB free, then $2/GiB up to 10 GiB, $1/GiB to 100 GiB, $0.50/GiB to 1,000 GiB and $0.25/GiB beyond.
Cloudsmith
- Standards: PEP 503 HTML index. PEP 658 metadata files rolled out from May 2026, with uv named as a supported client. No JSON index, yanking or project status.
- Authentication: username
tokenwith a user API key or entitlement token as the password. These don’t have a fixed expiry and can be rotated. OIDC tokens for CI last 2 hours. - Pricing: usage-based on storage and delivery bandwidth, no seats. Free tier with about 500 MB storage; Pro from about $149/month.
GitLab
- Standards: PEP 503 HTML index per project or group. The PEP 691 JSON index arrived behind a feature flag in 18.10 and is generally available from 19.6. No metadata files, yanking or project status.
- Authentication: uv has no GitLab guide, so use
UV_INDEX_<NAME>_USERNAME/PASSWORDwith a personal access token (read_api), a deploy token (read_package_registry) or, in CI,gitlab-ci-tokenand$CI_JOB_TOKEN. PATs last up to 365 days; deploy tokens don’t expire by default; job tokens only last for the job. - Pricing: per seat, from about $29/user/month for Premium. The package registry is on the free tier too.
Google Artifact Registry
- Standards: PEP 503 HTML index. No JSON index; no PEP 658 metadata files (an open request on Google’s tracker). No yanking or project status.
- Authentication: username
oauth2accesstokenwithgcloud auth application-default print-access-tokenas the password, orkeyringwithkeyrings.google-artifactregistry-auth. Access tokens last one hour. A base64-encoded service account key (username_json_key_base64) doesn’t expire, but Google calls it the least secure option. - Pricing: $0.10/GB-month storage after 0.5 GB free, plus network egress. No seats.
JFrog Artifactory
- Standards: PEP 503 HTML and PEP 691 JSON indexes, PEP 592 yanking. PEP 658 metadata files are behind a system property that is off by default; on SaaS you ask JFrog support to turn it on. No PEP 792.
- Authentication: an access token as the password with an empty username. For
uv publish, pass-u "" -p $TOKENrather than--token. Token lifetime is configurable by the administrator. - Pricing: plan plus consumption (storage and transfer combined). Pro from $150/month with 25 GB included.
RepoForge.io
- Standards: the index follows PEP 503 and PEP 691 (HTML and JSON), serves PEP 658/714 metadata files, supports PEP 592 yanking and PEP 792 project status, and checks
Requires-Python. The full list is in the docs. - Authentication: an access token in the index URL with
__token__as the username, for exampleUV_INDEX_URL=https://__token__:<token>@api.repoforge.io/<your-hash-id>/. Tokens last until you revoke them, and every paid plan includes unlimited tokens. See How to install private Python packages with uv. - Pricing: per user per month, from £10/user/month billed yearly. Storage depends on the plan, and bandwidth isn’t metered. There’s a free plan for public packages. See pricing.
Choosing one
If your infrastructure already lives in AWS, Google Cloud, Azure or GitLab, their registries keep billing and access control in one place, at the cost of short-lived credentials (CodeArtifact, Google) or missing newer index standards. If standards support and long-lived tokens matter more, compare the per-user and usage-based prices above against your team size and storage.