The Python Package Index (PyPI) is the public repository of third-party Python packages, operated by the Python Software Foundation (PSF) under the PyPI Terms of Service. The current Terms took effect on 2025-02-25 and replaced the earlier PyPI Terms of Use.[1][7] The PSF licence that covers CPython does not cover packages on PyPI. Uploaders keep ownership of their content, and each package is licensed on whatever terms its uploader specifies.[1] For an organization that uses Python, most licence obligations therefore come from the packages it installs, not from Python itself. The PSF’s one paid PyPI service is the Corporate Organization account, billed per member User per month.[2]
How packages are licensed
Ownership and inbound=outbound (effective 2025-02-25). Uploaders keep ownership of and responsibility for their content. They must only submit content they have the right to post, and must comply with any third-party licences that apply to it.[1] When content is added with a specified licence, the uploader licenses it under those terms. A separate agreement such as a contributor licence agreement takes precedence. The Terms call this “inbound=outbound”.[1] Catalog proof: PyPI packages are licensed by their authors, not by the PSF.
Grant to the PSF and to users. If the package’s own licence already allows free redistribution by the PSF, no extra grant is needed. The uploader warrants that the content meets the requirements for free redistribution by the PSF, by users and by public or private mirrors.[1] Content uploaded without such a licence is covered by a fallback. The uploader grants the PSF and all other users of the service an irrevocable, worldwide, royalty-free, nonexclusive licence to reproduce, distribute, transmit, display, perform and publish it. That grant does not let the PSF sell the content.[1] Catalog proof: Unlicensed PyPI uploads grant users a redistribution licence.
What this means for users (commentary). The fallback grant covers reproducing and distributing a package. It does not by itself grant rights to modify the package or build it into a product. Each package’s own licence, which may be permissive, copyleft or proprietary, sets those rights. PyPI-compatible servers run by third parties, such as internal mirrors, are governed by their operators’ terms, if any.[1]
Licence metadata
Package licences are declared in the distribution’s core metadata:
| Field | Status | Content |
|---|---|---|
License-Expression | Added in metadata 2.4 | A valid SPDX licence expression, for example MIT or MIT AND (Apache-2.0 OR BSD-2-Clause); custom references such as LicenseRef-Proprietary are also shown[5] |
License-File | Added in metadata 2.4 | Path of each licence-related file, relative to the project root[5] |
License | Deprecated in 2.4 | Free text. It cannot be combined with License-Expression: tools ignore it and PyPI rejects such uploads[5] |
Classifier: License :: | Deprecated in 2.4 | Trove classifiers; replaced by License-Expression[5] |
A License-Expression applies only to the distribution archive (sdist or wheel) that contains it. It does not describe the project as a whole or its other archives.[5] In a wheel, licence files are stored under the .dist-info/licenses/ directory and unpacked from there into the site directory on installation.[6] Catalog proof: License-Expression metadata covers only its distribution archive.
Organization accounts
PyPI organization accounts let users from an organization or community project form teams and collaborate on projects. There are two kinds. Private or corporate organizations pay a monthly subscription fee, and community projects get the same features free of charge.[3]
| Program | Price | Payment terms |
|---|---|---|
| PyPI Corporate Organization | $5 per member User, per month[2] | Invoiced monthly, based on usage; payment due on receipt[2] |
| PyPI Community Organization | No cost[2] | No payment or billing information required[2] |
The metric is the PyPI organization member User, and the price point is recorded as the SKU PyPI Corporate Organization - per member User per month.
Counting (effective 2025-02-25). Per-seat organization membership is billed on usage and charged in arrears for the preceding month.[1] A login may be used by only one person. A paid Organization may give access only to as many Personal Accounts as its subscription allows.[1] Each user may keep one free machine account in addition to a free Personal Account.[1] PyPI sets no limit on the number of users or teams in an organization.[4] Catalog proof: PyPI Corporate Organizations are billed per member User per month.
Price changes and refunds. An agreed subscription price holds for the payment term and may change at the end of it. The PSF may bill immediately when a paid corporate Organization is registered.[1] Plan-based services are billed in advance and are non-refundable, although the Terms note that no services are currently billed by plan.[1]
What organizations do not include. Organization accounts support neither private packages nor namespaces. PyPI administrators approve each organization request and check that private organizations are billed.[4] There is no dedicated user support for organization accounts.[4]
Software asset management practice
The points below apply the cited documents to SAM work. They are commentary.
- Inventory packages, not only interpreters. Each environment (virtual environment, container image, embedded runtime) has its own set of installed distributions. The
License-ExpressionandLicense-Filemetadata of each one is the primary machine-readable licence record.[5] - Handle legacy metadata. Older distributions may declare a licence only in the free-text
Licensefield or asLicense ::classifiers, both deprecated in metadata 2.4.[5] Map these to SPDX identifiers with care, and check the bundled licence files. - Check per archive. Because an expression covers only its own archive, a wheel and an sdist of the same release, or wheels for different platforms, can declare different licences.[5]
- Count Corporate Organization members. For a company account on pypi.org, the billable quantity is the monthly number of member Personal Accounts.[1][2] Removing leavers from the organization reduces the next invoice.
Out of scope
- The licence terms of any individual package, including commercial packages distributed through PyPI.
- Third-party PyPI-compatible repositories and mirrors, which have their own terms.[1]
- PyPI’s Acceptable Use Policy, API terms and copyright takedown procedure, except where they affect licensing.