Private registry dependencies using API token

• I am on the latest Poetry version.
• I have searched the issues of this repo and believe that this is not a duplicate.
• If an exception occurs when executing a command, I executed it again in debug mode (-vvv option).

• ubuntu 18.04
• poetry 1.0.5

Issue

Apologies for the brevity of this description, i'm not in front of my machine right now. There may be a very simple answer to this question.

Are private pypi registries accessible using the API token, rather than username/password? I see that API token support for the public pypi registry was added in #1275, was this intended to also provide support for non-public registries?

• we have an Artifactory-hosted pypi registry
• we can use poetry with this registry using username and password authentication
• we cannot use API token authentication with this registry
• we have security concerns with using username/password authentication
• other tools (such as twine) are able to access this registry using the API token, rather than username/password

I guess i'm asking if some part of the API token authentication implementation is hardcoded to the public pypi registry?

If it is intended that this should work, what diagnostic information can I provide, or debugging steps can I follow?

(note that i'm lagging a couple of releases on the poetry version. Please let me know if there's any changes that could affect this that are undocumented in the changelog)

Start by reproducing API-token authentication against the Artifactory-hosted PyPI registry using Poetry 1.0.5, comparing it with username/password authentication and the public PyPI behavior added in #1275. Determine whether private registries are intended to support tokens, then document the required diagnostic result or implementation scope.