By default, requests accesses user's .netrc . Disable this using the only available (though undocumented) way: by having requests distrust the environment. An unfortunate side-effect is that it will now also ignore proxy settings (which do come from the environment variables, which would be fine to access for me, unlike the .netrc).