diff --git a/.gitignore b/.gitignore
index 09bc53c..b9f9849 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,5 @@ bin/
 develop-eggs/
 eggs/
 parts/
+
+docs/_build/
diff --git a/.travis.yml b/.travis.yml
index 4847904..2facdb7 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -6,10 +6,13 @@ python:
     - 3.4
     - 3.5
     - pypy
-    - pypy3
+    - pypy3.5-5.8.0
 install:
-    - pip install .
+    - pip install -U setuptools pip
+    - pip install -U coveralls coverage
+    - pip install -U -e .[test]
 script:
-    - python setup.py -q test -q
+    - zope-testrunner --test-path=src
 notifications:
     email: false
+cache: pip
diff --git a/CHANGES.rst b/CHANGES.rst
index d3e8185..6961ff0 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -1,16 +1,18 @@
-Changes
-=======
+=========
+ Changes
+=========
 
 4.1.0 (unreleased)
-------------------
+==================
 
 - Add support for Python 3.5.
 
 - Drop support for Python 2.6.
 
+- Host documentation at https://zopeprincipalregistry.readthedocs.io
 
 4.0.0 (2014-12-24)
-------------------
+==================
 
 - Add support for PyPy.  (PyPy3 is pending release of a fix for:
   https://bitbucket.org/pypy/pypy/issue/1946)
@@ -21,7 +23,7 @@ Changes
 
 
 4.0.0a2 (2013-03-03)
---------------------
+====================
 
 - Make sure that the password is always bytes when passed into the principal
   registry.
@@ -30,7 +32,7 @@ Changes
 
 
 4.0.0a1 (2013-02-22)
---------------------
+====================
 
 - Add support for Python 3.3.
 
@@ -41,7 +43,7 @@ Changes
 
 
 3.7.1 (2010-09-25)
-------------------
+==================
 
 - Add test extra to declare test dependency on ``zope.component [test]``.
 
@@ -50,7 +52,7 @@ Changes
 
 
 3.7.0 (2009-03-14)
-------------------
+==================
 
 - Remove ``zope.container`` dependency, as contained principals didn't make any
   sense, since PrincipalRegistry never provided IContainer. Also, zope.container
diff --git a/README.rst b/README.rst
index 0218c8f..576e961 100644
--- a/README.rst
+++ b/README.rst
@@ -1,8 +1,28 @@
-``zope.principalregistry``
-==========================
+============================
+ ``zope.principalregistry``
+============================
+
+.. image:: https://img.shields.io/pypi/v/zope.principalregistry.svg
+        :target: https://pypi.python.org/pypi/zope.principalregistry/
+        :alt: Latest release
+
+.. image:: https://img.shields.io/pypi/pyversions/zope.principalregistry.svg
+        :target: https://pypi.org/project/zope.principalregistry/
+        :alt: Supported Python versions
 
 .. image:: https://travis-ci.org/zopefoundation/zope.principalregistry.png?branch=master
         :target: https://travis-ci.org/zopefoundation/zope.principalregistry
 
+.. image:: https://coveralls.io/repos/github/zopefoundation/zope.principalregistry/badge.svg?branch=master
+        :target: https://coveralls.io/github/zopefoundation/zope.principalregistry?branch=master
+
+.. image:: https://readthedocs.org/projects/zopeprincipalregistry/badge/?version=latest
+        :target: https://zopeprincipalregistry.readthedocs.io/en/latest/
+        :alt: Documentation Status
+
 This package provides an authentication utility for ``zope.authentication``
-that uses simple non-persistent principal registry.
+that uses a simple non-persistent principal registry. This is
+typically registered as a global utility, and it is usually configured
+in ZCML.
+
+Documentation is hosted at https://zopeprincipalregistry.readthedocs.io
diff --git a/docs-requirements.txt b/docs-requirements.txt
new file mode 100644
index 0000000..f4eb4ef
--- /dev/null
+++ b/docs-requirements.txt
@@ -0,0 +1,1 @@
+repoze.sphinx.autointerface
diff --git a/docs/Makefile b/docs/Makefile
new file mode 100644
index 0000000..b44c7f7
--- /dev/null
+++ b/docs/Makefile
@@ -0,0 +1,225 @@
+# Makefile for Sphinx documentation
+#
+
+# You can set these variables from the command line.
+SPHINXOPTS    =
+SPHINXBUILD   = sphinx-build
+PAPER         =
+BUILDDIR      = _build
+
+# Internal variables.
+PAPEROPT_a4     = -D latex_paper_size=a4
+PAPEROPT_letter = -D latex_paper_size=letter
+ALLSPHINXOPTS   = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
+# the i18n builder cannot share the environment and doctrees with the others
+I18NSPHINXOPTS  = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
+
+.PHONY: help
+help:
+	@echo "Please use \`make <target>' where <target> is one of"
+	@echo "  html       to make standalone HTML files"
+	@echo "  dirhtml    to make HTML files named index.html in directories"
+	@echo "  singlehtml to make a single large HTML file"
+	@echo "  pickle     to make pickle files"
+	@echo "  json       to make JSON files"
+	@echo "  htmlhelp   to make HTML files and a HTML help project"
+	@echo "  qthelp     to make HTML files and a qthelp project"
+	@echo "  applehelp  to make an Apple Help Book"
+	@echo "  devhelp    to make HTML files and a Devhelp project"
+	@echo "  epub       to make an epub"
+	@echo "  epub3      to make an epub3"
+	@echo "  latex      to make LaTeX files, you can set PAPER=a4 or PAPER=letter"
+	@echo "  latexpdf   to make LaTeX files and run them through pdflatex"
+	@echo "  latexpdfja to make LaTeX files and run them through platex/dvipdfmx"
+	@echo "  text       to make text files"
+	@echo "  man        to make manual pages"
+	@echo "  texinfo    to make Texinfo files"
+	@echo "  info       to make Texinfo files and run them through makeinfo"
+	@echo "  gettext    to make PO message catalogs"
+	@echo "  changes    to make an overview of all changed/added/deprecated items"
+	@echo "  xml        to make Docutils-native XML files"
+	@echo "  pseudoxml  to make pseudoxml-XML files for display purposes"
+	@echo "  linkcheck  to check all external links for integrity"
+	@echo "  doctest    to run all doctests embedded in the documentation (if enabled)"
+	@echo "  coverage   to run coverage check of the documentation (if enabled)"
+	@echo "  dummy      to check syntax errors of document sources"
+
+.PHONY: clean
+clean:
+	rm -rf $(BUILDDIR)/*
+
+.PHONY: html
+html:
+	$(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html
+	@echo
+	@echo "Build finished. The HTML pages are in $(BUILDDIR)/html."
+
+.PHONY: dirhtml
+dirhtml:
+	$(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml
+	@echo
+	@echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml."
+
+.PHONY: singlehtml
+singlehtml:
+	$(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml
+	@echo
+	@echo "Build finished. The HTML page is in $(BUILDDIR)/singlehtml."
+
+.PHONY: pickle
+pickle:
+	$(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle
+	@echo
+	@echo "Build finished; now you can process the pickle files."
+
+.PHONY: json
+json:
+	$(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json
+	@echo
+	@echo "Build finished; now you can process the JSON files."
+
+.PHONY: htmlhelp
+htmlhelp:
+	$(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp
+	@echo
+	@echo "Build finished; now you can run HTML Help Workshop with the" \
+	      ".hhp project file in $(BUILDDIR)/htmlhelp."
+
+.PHONY: qthelp
+qthelp:
+	$(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp
+	@echo
+	@echo "Build finished; now you can run "qcollectiongenerator" with the" \
+	      ".qhcp project file in $(BUILDDIR)/qthelp, like this:"
+	@echo "# qcollectiongenerator $(BUILDDIR)/qthelp/zcintid.qhcp"
+	@echo "To view the help file:"
+	@echo "# assistant -collectionFile $(BUILDDIR)/qthelp/zcintid.qhc"
+
+.PHONY: applehelp
+applehelp:
+	$(SPHINXBUILD) -b applehelp $(ALLSPHINXOPTS) $(BUILDDIR)/applehelp
+	@echo
+	@echo "Build finished. The help book is in $(BUILDDIR)/applehelp."
+	@echo "N.B. You won't be able to view it unless you put it in" \
+	      "~/Library/Documentation/Help or install it in your application" \
+	      "bundle."
+
+.PHONY: devhelp
+devhelp:
+	$(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp
+	@echo
+	@echo "Build finished."
+	@echo "To view the help file:"
+	@echo "# mkdir -p $$HOME/.local/share/devhelp/zcintid"
+	@echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/zcintid"
+	@echo "# devhelp"
+
+.PHONY: epub
+epub:
+	$(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub
+	@echo
+	@echo "Build finished. The epub file is in $(BUILDDIR)/epub."
+
+.PHONY: epub3
+epub3:
+	$(SPHINXBUILD) -b epub3 $(ALLSPHINXOPTS) $(BUILDDIR)/epub3
+	@echo
+	@echo "Build finished. The epub3 file is in $(BUILDDIR)/epub3."
+
+.PHONY: latex
+latex:
+	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
+	@echo
+	@echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex."
+	@echo "Run \`make' in that directory to run these through (pdf)latex" \
+	      "(use \`make latexpdf' here to do that automatically)."
+
+.PHONY: latexpdf
+latexpdf:
+	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
+	@echo "Running LaTeX files through pdflatex..."
+	$(MAKE) -C $(BUILDDIR)/latex all-pdf
+	@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
+
+.PHONY: latexpdfja
+latexpdfja:
+	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
+	@echo "Running LaTeX files through platex and dvipdfmx..."
+	$(MAKE) -C $(BUILDDIR)/latex all-pdf-ja
+	@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
+
+.PHONY: text
+text:
+	$(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text
+	@echo
+	@echo "Build finished. The text files are in $(BUILDDIR)/text."
+
+.PHONY: man
+man:
+	$(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man
+	@echo
+	@echo "Build finished. The manual pages are in $(BUILDDIR)/man."
+
+.PHONY: texinfo
+texinfo:
+	$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
+	@echo
+	@echo "Build finished. The Texinfo files are in $(BUILDDIR)/texinfo."
+	@echo "Run \`make' in that directory to run these through makeinfo" \
+	      "(use \`make info' here to do that automatically)."
+
+.PHONY: info
+info:
+	$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
+	@echo "Running Texinfo files through makeinfo..."
+	make -C $(BUILDDIR)/texinfo info
+	@echo "makeinfo finished; the Info files are in $(BUILDDIR)/texinfo."
+
+.PHONY: gettext
+gettext:
+	$(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale
+	@echo
+	@echo "Build finished. The message catalogs are in $(BUILDDIR)/locale."
+
+.PHONY: changes
+changes:
+	$(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes
+	@echo
+	@echo "The overview file is in $(BUILDDIR)/changes."
+
+.PHONY: linkcheck
+linkcheck:
+	$(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck
+	@echo
+	@echo "Link check complete; look for any errors in the above output " \
+	      "or in $(BUILDDIR)/linkcheck/output.txt."
+
+.PHONY: doctest
+doctest:
+	$(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest
+	@echo "Testing of doctests in the sources finished, look at the " \
+	      "results in $(BUILDDIR)/doctest/output.txt."
+
+.PHONY: coverage
+coverage:
+	$(SPHINXBUILD) -b coverage $(ALLSPHINXOPTS) $(BUILDDIR)/coverage
+	@echo "Testing of coverage in the sources finished, look at the " \
+	      "results in $(BUILDDIR)/coverage/python.txt."
+
+.PHONY: xml
+xml:
+	$(SPHINXBUILD) -b xml $(ALLSPHINXOPTS) $(BUILDDIR)/xml
+	@echo
+	@echo "Build finished. The XML files are in $(BUILDDIR)/xml."
+
+.PHONY: pseudoxml
+pseudoxml:
+	$(SPHINXBUILD) -b pseudoxml $(ALLSPHINXOPTS) $(BUILDDIR)/pseudoxml
+	@echo
+	@echo "Build finished. The pseudo-XML files are in $(BUILDDIR)/pseudoxml."
+
+.PHONY: dummy
+dummy:
+	$(SPHINXBUILD) -b dummy $(ALLSPHINXOPTS) $(BUILDDIR)/dummy
+	@echo
+	@echo "Build finished. Dummy builder generates no files."
diff --git a/docs/api.rst b/docs/api.rst
new file mode 100644
index 0000000..0c01903
--- /dev/null
+++ b/docs/api.rst
@@ -0,0 +1,14 @@
+===============
+ API Reference
+===============
+
+Registry
+========
+
+.. automodule:: zope.principalregistry.principalregistry
+
+ZCML Directives
+===============
+
+.. automodule:: zope.principalregistry.metadirectives
+.. automodule:: zope.principalregistry.metaconfigure
diff --git a/docs/changelog.rst b/docs/changelog.rst
new file mode 100644
index 0000000..d9e113e
--- /dev/null
+++ b/docs/changelog.rst
@@ -0,0 +1,1 @@
+.. include:: ../CHANGES.rst
diff --git a/docs/conf.py b/docs/conf.py
new file mode 100644
index 0000000..40267be
--- /dev/null
+++ b/docs/conf.py
@@ -0,0 +1,371 @@
+# -*- coding: utf-8 -*-
+#
+# zope.app.apidoc documentation build configuration file, created by
+# sphinx-quickstart on Tue Sep 13 15:00:43 2016.
+#
+# This file is execfile()d with the current directory set to its
+# containing dir.
+#
+# Note that not all possible configuration values are present in this
+# autogenerated file.
+#
+# All configuration values have a default; values that are commented out
+# serve to show the default.
+
+# If extensions (or modules to document with autodoc) are in another directory,
+# add these directories to sys.path here. If the directory is relative to the
+# documentation root, use os.path.abspath to make it absolute, like shown here.
+#
+# import os
+# import sys
+# sys.path.insert(0, os.path.abspath('.'))
+import os
+import sys
+import pkg_resources
+sys.path.append(os.path.abspath('../src'))
+rqmt = pkg_resources.require('zope.principalregistry')[0]
+
+# -- General configuration ------------------------------------------------
+
+# If your documentation needs a minimal Sphinx version, state it here.
+#
+# needs_sphinx = '1.0'
+
+# Add any Sphinx extension module names here, as strings. They can be
+# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
+# ones.
+extensions = [
+    'sphinx.ext.autodoc',
+    'sphinx.ext.intersphinx',
+    'sphinx.ext.viewcode',
+    'sphinx.ext.extlinks',
+    'repoze.sphinx.autointerface',
+]
+
+# Add any paths that contain templates here, relative to this directory.
+templates_path = ['_templates']
+
+# The suffix(es) of source filenames.
+# You can specify multiple suffix as a list of string:
+#
+# source_suffix = ['.rst', '.md']
+source_suffix = '.rst'
+
+# The encoding of source files.
+#
+# source_encoding = 'utf-8-sig'
+
+# The master toctree document.
+master_doc = 'index'
+
+# General information about the project.
+project = u'zope.principalregistry'
+copyright = u'2017, Zope Community'
+author = u'Zope Community'
+
+# The version info for the project you're documenting, acts as replacement for
+# |version| and |release|, also used in various other places throughout the
+# built documents.
+#
+# The short X.Y version.
+version = '%s.%s' % tuple(map(int, rqmt.version.split('.')[:2]))
+# The full version, including alpha/beta/rc tags.
+release = rqmt.version
+
+# The language for content autogenerated by Sphinx. Refer to documentation
+# for a list of supported languages.
+#
+# This is also used if you do content translation via gettext catalogs.
+# Usually you set "language" from the command line for these cases.
+language = None
+
+# There are two options for replacing |today|: either, you set today to some
+# non-false value, then it is used:
+#
+# today = ''
+#
+# Else, today_fmt is used as the format for a strftime call.
+#
+# today_fmt = '%B %d, %Y'
+
+# List of patterns, relative to source directory, that match files and
+# directories to ignore when looking for source files.
+# This patterns also effect to html_static_path and html_extra_path
+exclude_patterns = ['_build', 'Thumbs.db', '.DS_Store']
+
+# The reST default role (used for this markup: `text`) to use for all
+# documents.
+#
+# default_role = None
+
+# If true, '()' will be appended to :func: etc. cross-reference text.
+#
+# add_function_parentheses = True
+
+# If true, the current module name will be prepended to all description
+# unit titles (such as .. function::).
+#
+# add_module_names = True
+
+# If true, sectionauthor and moduleauthor directives will be shown in the
+# output. They are ignored by default.
+#
+# show_authors = False
+
+# The name of the Pygments (syntax highlighting) style to use.
+pygments_style = 'sphinx'
+
+# A list of ignored prefixes for module index sorting.
+# modindex_common_prefix = []
+
+# If true, keep warnings as "system message" paragraphs in the built documents.
+# keep_warnings = False
+
+# If true, `todo` and `todoList` produce output, else they produce nothing.
+todo_include_todos = False
+
+
+# -- Options for HTML output ----------------------------------------------
+
+# The theme to use for HTML and HTML Help pages.  See the documentation for
+# a list of builtin themes.
+#
+html_theme = 'default'
+
+# Theme options are theme-specific and customize the look and feel of a theme
+# further.  For a list of options available for each theme, see the
+# documentation.
+#
+# html_theme_options = {}
+
+# Add any paths that contain custom themes here, relative to this directory.
+# html_theme_path = []
+
+# The name for this set of Sphinx documents.
+# "<project> v<release> documentation" by default.
+#
+# html_title = u'zope.principalregistry vXXX'
+
+# A shorter title for the navigation bar.  Default is the same as html_title.
+#
+# html_short_title = None
+
+# The name of an image file (relative to this directory) to place at the top
+# of the sidebar.
+#
+# html_logo = None
+
+# The name of an image file (relative to this directory) to use as a favicon of
+# the docs.  This file should be a Windows icon file (.ico) being 16x16 or 32x32
+# pixels large.
+#
+# html_favicon = None
+
+# Add any paths that contain custom static files (such as style sheets) here,
+# relative to this directory. They are copied after the builtin static files,
+# so a file named "default.css" will overwrite the builtin "default.css".
+html_static_path = ['_static']
+
+# Add any extra paths that contain custom files (such as robots.txt or
+# .htaccess) here, relative to this directory. These files are copied
+# directly to the root of the documentation.
+#
+# html_extra_path = []
+
+# If not None, a 'Last updated on:' timestamp is inserted at every page
+# bottom, using the given strftime format.
+# The empty string is equivalent to '%b %d, %Y'.
+#
+# html_last_updated_fmt = None
+
+# If true, SmartyPants will be used to convert quotes and dashes to
+# typographically correct entities.
+#
+# html_use_smartypants = True
+
+# Custom sidebar templates, maps document names to template names.
+#
+# html_sidebars = {}
+
+# Additional templates that should be rendered to pages, maps page names to
+# template names.
+#
+# html_additional_pages = {}
+
+# If false, no module index is generated.
+#
+# html_domain_indices = True
+
+# If false, no index is generated.
+#
+# html_use_index = True
+
+# If true, the index is split into individual pages for each letter.
+#
+# html_split_index = False
+
+# If true, links to the reST sources are added to the pages.
+#
+# html_show_sourcelink = True
+
+# If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
+#
+# html_show_sphinx = True
+
+# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
+#
+# html_show_copyright = True
+
+# If true, an OpenSearch description file will be output, and all pages will
+# contain a <link> tag referring to it.  The value of this option must be the
+# base URL from which the finished HTML is served.
+#
+# html_use_opensearch = ''
+
+# This is the file name suffix for HTML files (e.g. ".xhtml").
+# html_file_suffix = None
+
+# Language to be used for generating the HTML full-text search index.
+# Sphinx supports the following languages:
+#   'da', 'de', 'en', 'es', 'fi', 'fr', 'hu', 'it', 'ja'
+#   'nl', 'no', 'pt', 'ro', 'ru', 'sv', 'tr', 'zh'
+#
+# html_search_language = 'en'
+
+# A dictionary with options for the search language support, empty by default.
+# 'ja' uses this config value.
+# 'zh' user can custom change `jieba` dictionary path.
+#
+# html_search_options = {'type': 'default'}
+
+# The name of a javascript file (relative to the configuration directory) that
+# implements a search results scorer. If empty, the default will be used.
+#
+# html_search_scorer = 'scorer.js'
+
+# Output file base name for HTML help builder.
+htmlhelp_basename = 'zopeprincipalregistry'
+
+# -- Options for LaTeX output ---------------------------------------------
+
+latex_elements = {
+     # The paper size ('letterpaper' or 'a4paper').
+     #
+     # 'papersize': 'letterpaper',
+
+     # The font size ('10pt', '11pt' or '12pt').
+     #
+     # 'pointsize': '10pt',
+
+     # Additional stuff for the LaTeX preamble.
+     #
+     # 'preamble': '',
+
+     # Latex figure (float) alignment
+     #
+     # 'figure_align': 'htbp',
+}
+
+# Grouping the document tree into LaTeX files. List of tuples
+# (source start file, target name, title,
+#  author, documentclass [howto, manual, or own class]).
+latex_documents = [
+    (master_doc, 'zopeprincipalregistry.tex', u'zope.principalregistry Documentation',
+     u'Zope Community', 'manual'),
+]
+
+# The name of an image file (relative to this directory) to place at the top of
+# the title page.
+#
+# latex_logo = None
+
+# For "manual" documents, if this is true, then toplevel headings are parts,
+# not chapters.
+#
+# latex_use_parts = False
+
+# If true, show page references after internal links.
+#
+# latex_show_pagerefs = False
+
+# If true, show URL addresses after external links.
+#
+# latex_show_urls = False
+
+# Documents to append as an appendix to all manuals.
+#
+# latex_appendices = []
+
+# It false, will not define \strong, \code, 	itleref, \crossref ... but only
+# \sphinxstrong, ..., \sphinxtitleref, ... To help avoid clash with user added
+# packages.
+#
+# latex_keep_old_macro_names = True
+
+# If false, no module index is generated.
+#
+# latex_domain_indices = True
+
+
+# -- Options for manual page output ---------------------------------------
+
+# One entry per manual page. List of tuples
+# (source start file, name, description, authors, manual section).
+man_pages = [
+    (master_doc, 'zopeprincipalregistry', u'zope.principalregistry Documentation',
+     [author], 1)
+]
+
+# If true, show URL addresses after external links.
+#
+# man_show_urls = False
+
+
+# -- Options for Texinfo output -------------------------------------------
+
+# Grouping the document tree into Texinfo files. List of tuples
+# (source start file, target name, title, author,
+#  dir menu entry, description, category)
+texinfo_documents = [
+    (master_doc, 'zopeprincipalregistry', u'zope.principalregistry Documentation',
+     author, 'zopeprincipalregistry', 'One line description of project.',
+     'Miscellaneous'),
+]
+
+# Documents to append as an appendix to all manuals.
+#
+# texinfo_appendices = []
+
+# If false, no module index is generated.
+#
+# texinfo_domain_indices = True
+
+# How to display URL addresses: 'footnote', 'no', or 'inline'.
+#
+# texinfo_show_urls = 'footnote'
+
+# If true, do not generate a @detailmenu in the "Top" node's menu.
+#
+# texinfo_no_detailmenu = False
+
+
+# Example configuration for intersphinx: refer to the Python standard library.
+intersphinx_mapping = {
+    'https://docs.python.org/': None,
+    'https://zopepassword.readthedocs.io/en/latest/': None,
+    'https://zopecomponent.readthedocs.io/en/latest/': None,
+    'https://zopesecurity.readthedocs.io/en/latest/': None,
+    'https://zopeauthentication.readthedocs.io/en/latest/': None,
+}
+
+extlinks = {'issue': ('https://github.com/zopefoundation/zope.principalregistry/issues/%s',
+                      'issue #'),
+            'pr': ('https://github.com/zopefoundation/zope.principalregistry/pull/%s',
+                   'pull request #')}
+
+autodoc_default_flags = [
+    'members',
+    'show-inheritance',
+]
+autoclass_content = 'both'
+autodoc_member_order = 'bysource'
diff --git a/docs/index.rst b/docs/index.rst
new file mode 100644
index 0000000..d4ea590
--- /dev/null
+++ b/docs/index.rst
@@ -0,0 +1,36 @@
+.. include:: ../README.rst
+
+.. toctree::
+   :maxdepth: 2
+
+   narr
+   api
+
+
+.. toctree::
+   :maxdepth: 2
+
+   changelog
+
+Development
+===========
+
+zope.principalregistry is hosted at GitHub:
+
+    https://github.com/zopefoundation/zope.principalregistry/
+
+
+
+Project URLs
+============
+
+* https://pypi.python.org/pypi/zope.principalregistry       (PyPI entry and downloads)
+
+
+====================
+ Indices and tables
+====================
+
+* :ref:`genindex`
+* :ref:`modindex`
+* :ref:`search`
diff --git a/docs/narr.rst b/docs/narr.rst
new file mode 100644
index 0000000..a285790
--- /dev/null
+++ b/docs/narr.rst
@@ -0,0 +1,1 @@
+.. include:: ../src/zope/principalregistry/README.rst
diff --git a/setup.py b/setup.py
index 78a0f40..1874987 100644
--- a/setup.py
+++ b/setup.py
@@ -35,6 +35,11 @@ def alltests():
     suites = list(zope.testrunner.find.find_suites(options))
     return unittest.TestSuite(suites)
 
+TESTS_REQUIRE = [
+    'zope.testing',
+    'zope.testrunner',
+]
+
 setup(name='zope.principalregistry',
       version='4.1.0.dev0',
       author='Zope Foundation and Contributors',
@@ -43,12 +48,10 @@ setup(name='zope.principalregistry',
       long_description=(
           read('README.rst')
           + '\n\n' +
-          read('src', 'zope', 'principalregistry', 'README.txt')
-          + '\n\n' +
           read('CHANGES.rst')
-          ),
-      keywords = "zope security authentication principal registry",
-      classifiers = [
+      ),
+      keywords="zope security authentication principal registry",
+      classifiers=[
           'Development Status :: 5 - Production/Stable',
           'Environment :: Web Environment',
           'Intended Audience :: Developers',
@@ -65,28 +68,30 @@ setup(name='zope.principalregistry',
           'Natural Language :: English',
           'Operating System :: OS Independent',
           'Topic :: Internet :: WWW/HTTP',
-          'Framework :: Zope3'],
+          'Framework :: Zope3',
+      ],
       url='https://github.com/zopefoundation/zope.principalregistry',
       license='ZPL 2.1',
       packages=find_packages('src'),
-      package_dir = {'': 'src'},
+      package_dir={'': 'src'},
       namespace_packages=['zope'],
-      install_requires=['setuptools',
-                        'zope.authentication',
-                        'zope.component',
-                        'zope.interface',
-                        'zope.password',
-                        'zope.security',
-                        ],
-      extras_require=dict(
-          test=[
-              'zope.testing',
-              ]),
-      tests_require = [
-          'zope.testing',
-          'zope.testrunner',
+      install_requires=[
+          'setuptools',
+          'zope.authentication',
+          'zope.component',
+          'zope.interface',
+          'zope.password',
+          'zope.security',
+      ],
+      extras_require={
+          'test': TESTS_REQUIRE,
+          'docs': [
+              'Sphinx',
+              'repoze.sphinx.autointerface',
           ],
-      test_suite = '__main__.alltests',
-      include_package_data = True,
-      zip_safe = False,
-      )
+      },
+      tests_require=TESTS_REQUIRE,
+      test_suite='__main__.alltests',
+      include_package_data=True,
+      zip_safe=False,
+)
diff --git a/src/zope/principalregistry/README.txt b/src/zope/principalregistry/README.rst
similarity index 93%
rename from src/zope/principalregistry/README.txt
rename to src/zope/principalregistry/README.rst
index 8e68f84..a7d704c 100644
--- a/src/zope/principalregistry/README.txt
+++ b/src/zope/principalregistry/README.rst
@@ -1,11 +1,17 @@
-Global principal definition
-===========================
+=============================
+ Global principal definition
+=============================
 
-Global principals are defined via ZCML.  There are several kinds of
-principals that can be defined.
+Global principals are defined via ZCML and are placed in
+:data:`zope.principalregistry.principalregistry.principalRegistry`.
+There are several kinds of principals that can be defined.
+
+When you use ZCML to configure this package (load its
+``configure.zcml``) that registry becomes a global utility
+implementing :class:`zope.authentication.interfaces.IAuthentication`.
 
 Authenticated Users
--------------------
+===================
 
 There are principals that can log in:
 
@@ -31,7 +37,7 @@ There are principals that can log in:
     ('zope.manager', u'Manager', u'System Manager', u'admin', True)
 
 The unauthenticated principal
------------------------------
+=============================
 
 There is the unauthenticated principal:
 
@@ -65,7 +71,7 @@ same principal.
     ('zope.unknown', u'Anonymous user', u"A person we don't know")
 
 The unauthenticated group
--------------------------
+=========================
 
 An unauthenticated group can also be defined in ZCML:
 
@@ -141,7 +147,7 @@ registry:
     True
 
 The authenticated group
------------------------
+=======================
 
 There is an authenticated group:
 
@@ -205,7 +211,7 @@ Excluding unauthenticated principals, of course:
 
 
 The everybody group
--------------------
+===================
 
 Finally, there is an everybody group:
 
@@ -272,7 +278,7 @@ these groups with their principals, as appropriate.
 
 
 The system_user
----------------
+===============
 
 There is also a system_user that is defined in the code.  It will be returned
 from the getPrincipal method of the registry.
diff --git a/src/zope/principalregistry/metaconfigure.py b/src/zope/principalregistry/metaconfigure.py
index 6b232b7..0eb0c94 100644
--- a/src/zope/principalregistry/metaconfigure.py
+++ b/src/zope/principalregistry/metaconfigure.py
@@ -30,6 +30,9 @@ def _principal():
 
 def principal(_context, id, title, login,
         password, description='', password_manager="Plain Text"):
+    """
+    Implementation of :class:`zope.principalregistry.metadirectives.IDefinePrincipalDirective`.
+    """
     # Make sure password is encoded to bytes, which is required by the
     # principal registry.
     password = password.encode('utf-8')
@@ -49,6 +52,9 @@ def _unauthenticatedPrincipal():
         _everybodyGroup(group.id)
 
 def unauthenticatedPrincipal(_context, id, title, description=''):
+    """
+    Implementation of :class:`zope.principalregistry.metadirectives.IDefineUnauthenticatedPrincipalDirective`.
+    """
     principal = principalregistry.UnauthenticatedPrincipal(
         id, title, description)
     _context.action(
@@ -68,6 +74,9 @@ def _unauthenticatedGroup(group):
         p.groups.append(group)
 
 def unauthenticatedGroup(_context, id, title, description=''):
+    """
+    Implementation of :class:`zope.principalregistry.metadirectives.IDefineUnauthenticatedGroupDirective`.
+    """
     principal = principalregistry.UnauthenticatedGroup(
         id, title, description)
     utility(_context, interfaces.IUnauthenticatedGroup, principal)
@@ -90,6 +99,9 @@ def _authenticatedGroup(group):
             p.groups.append(group)
 
 def authenticatedGroup(_context, id, title, description=''):
+    """
+    Implementation of :class:`zope.principalregistry.metadirectives.IDefineAuthenticatedGroupDirective`.
+    """
     principal = principalregistry.AuthenticatedGroup(
         id, title, description)
     utility(_context, interfaces.IAuthenticatedGroup, principal)
@@ -115,6 +127,9 @@ def _everybodyGroup(group):
         p.groups.append(group)
 
 def everybodyGroup(_context, id, title, description=''):
+    """
+    Implementation of :class:`zope.principalregistry.metadirectives.IDefineEverybodyGroupDirective`.
+    """
     principal = principalregistry.EverybodyGroup(
         id, title, description)
     utility(_context, interfaces.IEveryoneGroup, principal)
diff --git a/src/zope/principalregistry/principalregistry.py b/src/zope/principalregistry/principalregistry.py
index 99a59c3..5572549 100644
--- a/src/zope/principalregistry/principalregistry.py
+++ b/src/zope/principalregistry/principalregistry.py
@@ -41,6 +41,10 @@ class DuplicateId(Exception):
 
 @implementer(IAuthentication, ILogout)
 class PrincipalRegistry(object):
+    """
+    An in-memory implementation of :class:`zope.authentication.interfaces.IAuthentication`
+    and :class:`zope.authentication.interfaces.ILogout`.
+    """
 
     # Methods implementing IAuthentication
 
@@ -141,6 +145,8 @@ class PrincipalRegistry(object):
         self.__defaultid = None
         self.__defaultObject = None
 
+#: The global registry that the ZCML directives will
+#: modify.
 principalRegistry = PrincipalRegistry()
 
 # Register our cleanup with Testing.CleanUp to make writing unit tests
@@ -170,6 +176,10 @@ class Group(PrincipalBase):
 
 @implementer(IGroupAwarePrincipal)
 class Principal(PrincipalBase):
+    """
+    The default implementation of :class:`zope.security.interfaces.IGroupAwarePrincipal`
+    that :class:`PrincipalRegistry` will create.
+    """
 
     def __init__(self, id, title, description, login,
             pw, pwManagerName="Plain Text"):
@@ -191,7 +201,7 @@ class Principal(PrincipalBase):
 
 @implementer(IUnauthenticatedPrincipal)
 class UnauthenticatedPrincipal(PrincipalBase):
-    pass
+    """An implementation of :class:`zope.authentication.interfaces.IUnauthenticatedPrincipal`."""
 
 
 fallback_unauthenticated_principal = (
@@ -205,13 +215,12 @@ fallback_unauthenticated_principal = (
 
 @implementer(IUnauthenticatedGroup)
 class UnauthenticatedGroup(Group):
-    pass
+    """An implementation of :class:`zope.authentication.interfaces.IUnauthenticatedGroup`."""
 
 @implementer(IAuthenticatedGroup)
 class AuthenticatedGroup(Group):
-    pass
+    """An implementation of :class:`zope.authentication.interfaces.IAuthenticatedGroup`."""
 
 @implementer(IEveryoneGroup)
 class EverybodyGroup(Group):
-    pass
-
+    """An implementation of :class:`zope.authentication.interfaces.IEverybodyGroup`."""
diff --git a/tox.ini b/tox.ini
index a4d00e0..b9124f8 100644
--- a/tox.ini
+++ b/tox.ini
@@ -4,15 +4,12 @@ envlist =
 
 [testenv]
 commands =
-    python setup.py -q test -q
-# without explicit deps, setup.py test will download a bunch of eggs into $PWD
-# (and it seems I can't use zope.dottedname[testing] here, so forget DRY)
+    zope-testrunner --test-path=src []
 deps =
-    zope.authentication
-    zope.component
-    zope.interface
-    zope.password
-    zope.security
-    zope.testing
-    zope.testrunner
+    .[test]
 
+[testenv:docs]
+commands =
+    sphinx-build -b html -d docs/_build/doctrees docs docs/_build/html
+deps =
+    .[docs]

Docs to RTD
diff --git a/src/zope/principalregistry/tests/test_doc.py b/src/zope/principalregistry/tests/test_doc.py
index b845839..6a4b331 100644
--- a/src/zope/principalregistry/tests/test_doc.py
+++ b/src/zope/principalregistry/tests/test_doc.py
@@ -51,9 +51,11 @@ def reset():
 def test_suite():
     return unittest.TestSuite((
         doctest.DocFileSuite(
-                '../README.txt',
-                setUp=setUp, tearDown=tearDown, checker=checker,
-                globs={'zcml': zcml,
-                       'reset': reset,
-                       'print_function': print_function}),
-        ))
+            '../README.rst',
+            setUp=setUp, tearDown=tearDown, checker=checker,
+            globs={
+                'zcml': zcml,
+                'reset': reset,
+                'print_function': print_function,
+            }),
+    ))

pip install -e .[test]
parse_log_pytest
requirements.txt
zope.authentication zope.component zope.interface zope.password zope.security zope.testing zope.testrunner pytest
3.5
requirements/base.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
attrs==22.2.0
certifi==2021.5.30
importlib-metadata==4.8.3
iniconfig==1.1.1
packaging==21.3
pluggy==1.0.0
py==1.11.0
pyparsing==3.1.4
pytest==7.0.1
six==1.17.0
tomli==1.2.3
typing_extensions==4.1.1
zipp==3.6.0
zope.authentication==4.5.0
zope.browser==2.4
zope.component==5.1.0
zope.configuration==4.4.1
zope.event==4.6
zope.exceptions==4.6
zope.hookable==5.4
zope.i18nmessageid==5.1.1
zope.interface==5.5.2
zope.location==4.3
zope.password==4.4
-e git+https://github.com/zopefoundation/zope.principalregistry.git@e632d442b915b935ca22efab1db4d4fe47eeed34#egg=zope.principalregistry
zope.proxy==4.6.1
zope.schema==6.2.1
zope.security==5.8
zope.testing==5.0.1
zope.testrunner==5.6

name: zope.principalregistry
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - certifi=2021.5.30=py36h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.3=he6710b0_2
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=1.1.1w=h7f8727e_0
  - pip=21.2.2=py36h06a4308_0
  - python=3.6.13=h12debd9_1
  - readline=8.2=h5eee18b_0
  - setuptools=58.0.4=py36h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - wheel=0.37.1=pyhd3eb1b0_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - attrs==22.2.0
      - importlib-metadata==4.8.3
      - iniconfig==1.1.1
      - packaging==21.3
      - pluggy==1.0.0
      - py==1.11.0
      - pyparsing==3.1.4
      - pytest==7.0.1
      - six==1.17.0
      - tomli==1.2.3
      - typing-extensions==4.1.1
      - zipp==3.6.0
      - zope-authentication==4.5.0
      - zope-browser==2.4
      - zope-component==5.1.0
      - zope-configuration==4.4.1
      - zope-event==4.6
      - zope-exceptions==4.6
      - zope-hookable==5.4
      - zope-i18nmessageid==5.1.1
      - zope-interface==5.5.2
      - zope-location==4.3
      - zope-password==4.4
      - zope-proxy==4.6.1
      - zope-schema==6.2.1
      - zope-security==5.8
      - zope-testing==5.0.1
      - zope-testrunner==5.6
prefix: /opt/conda/envs/zope.principalregistry

src/zope/principalregistry/tests/test_doc.py::test_suite
README.rst docs/conf.py src/zope/principalregistry/README.txt setup.py docs-requirements.txt docs/changelog.rst docs/Makefile .gitignore .travis.yml docs/narr.rst src/zope/principalregistry/metaconfigure.py tox.ini CHANGES.rst docs/api.rst docs/index.rst src/zope/principalregistry/principalregistry.py
README.rst docs/conf.py setup.py docs-requirements.txt docs/changelog.rst docs/Makefile src/zope/principalregistry/README.rst .gitignore .travis.yml docs/narr.rst src/zope/principalregistry/metaconfigure.py tox.ini CHANGES.rst docs/api.rst docs/index.rst src/zope/principalregistry/principalregistry.py