clarify Azure PAT usage

docs/configuration/indexes.md

@@ -138,10 +138,7 @@ While `unsafe-best-match` is the closest to pip's behavior, it exposes users to
 ## Providing credentials
 
 Most private registries require authentication to access packages, typically via a username and
-password (or access token).
-
-To authenticate with a provide index, either provide credentials via environment variables or embed
-them in the URL.
+password (or access token), either loaded from environment variables or embedded in the URL.
 
 For example, given an index named `internal-proxy` that requires a username (`public`) and password
 (`koala`), define the index (without credentials) in your `pyproject.toml`:
@@ -152,9 +149,9 @@ name = "internal-proxy"
 url = "https://example.com/simple"
 ```
 
-From there, you can set the `UV_INDEX_INTERNAL_PROXY_USERNAME` and
-`UV_INDEX_INTERNAL_PROXY_PASSWORD` environment variables, where `INTERNAL_PROXY` is the uppercase
-version of the index name, with non-alphanumeric characters replaced by underscores:
+Then set the `UV_INDEX_INTERNAL_PROXY_USERNAME` and `UV_INDEX_INTERNAL_PROXY_PASSWORD` environment
+variables, where `INTERNAL_PROXY` is the uppercase version of the index name, with non-alphanumeric
+characters replaced by underscores:
 
 ```sh
 export UV_INDEX_INTERNAL_PROXY_USERNAME=public

docs/guides/integration/alternative-indexes.md

@@ -29,15 +29,21 @@ Authenticate to a feed using a
 
 If there is a PAT available (eg
 [`$(System.AccessToken)` in an Azure pipeline](https://learn.microsoft.com/en-us/azure/devops/pipelines/build/variables?view=azure-devops&tabs=yaml#systemaccesstoken)),
-credentials can be provided via the "Basic" HTTP authentication scheme. Include the PAT in the
-password field of the URL. A username must be included as well, but can be any string.
+credentials can be provided via the `UV_INDEX_[index name]_[username/password]` environment
+variables as described in
+[Providing credentials](../../configuration/indexes.md#providing-credentials), using your PAT as the
+password and an arbitrary string like "dummy" as the username.
 
-For example, with the token stored in the `$ADO_PAT` environment variable, set the index URL with:
+Alternatively, encode credentials in the `UV_INDEX` environment variable. For example, with the
+token stored in the `$ADO_PAT` environment variable, set the index URL with:
 
 ```console
 $ export UV_INDEX=https://dummy:$ADO_PAT@pkgs.dev.azure.com/{organisation}/{project}/_packaging/{feedName}/pypi/simple/
 ```
 
+This method is not normally recommended since `uv sync` then copies the url to the `pyproject.toml`,
+exposing the PAT in plaintext.
+
 ### Using `keyring`
 
 If there is not a PAT available, authenticate to Artifacts using the