5 ms·

> Enabling 2FA on PyPI controls access to PyPI’s web interface, not publishing workflows. Kinda feel like it should. (I also own packages that are critical.)

• woodruffw 4y ago
  For publishing workflows, you should be using an API token (which only allows access to the upload endpoint and nothing else; critically, you can’t modify your account via an API token). This is consistent with how most other services handle both user and machine interaction, and (IMO) strikes the right balance between security and practicality.
  • dlor 4y ago
    And I hear this is improving to allow short-lived publication tokens and federation to prevent them from being leaked :)
    • woodruffw 4y ago
      Indeed! Thanks for bringing that up; there’s a ton of really great work coming in the near future.