-
Notifications
You must be signed in to change notification settings - Fork 883
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Recommend using project-scoped API access tokens for dist uploads #628
Comments
API tokens are now a production feature of PyPI and users should use them instead of passwords to upload. Toward pypa#628. Signed-off-by: Sumana Harihareswara <[email protected]>
@ewdurbin @di @woodruffw I could use your advice on answering https://twitter.com/Ewjoachim/status/1154474823717982208 per @webknjaz's note above. How should we advise people to deal with multiple tokens in |
@brainwane It's not super ideal but the support for multiple repos could be used for this
And then the user does |
Thanks @di. I'd love for someone to polish that and add it to the right place(s) on PyPUG. I'd also like for someone to update https://packaging.python.org/guides/migrating-to-pypi-org/#publishing-releases which still recommends user/password instead of API tokens. |
FWIW, there was some discussion about this in pypa/twine#496. |
FYI, I did some investigation, and it's not obvious how to use multiple project API tokens with twine and keyring: pypa/twine#565. |
Ref: pypi/warehouse#6211 (comment)
The distributing guide should now mention the possibility of getting access tokens on a per-project basis and recommend that for use at least in automatic CI/CD systems: https://packaging.python.org/guides/distributing-packages-using-setuptools/#create-an-account
Also: @ewjoachim brought up a question about storing multiple tokens
https://twitter.com/Ewjoachim/status/1154474823717982208. This should probably be also clearly answered in docs.
The text was updated successfully, but these errors were encountered: