You can create a new package via a "pending publisher"[1], which does not require a user-scoped token. (Note: even though PyPI calls them "user-scoped tokens,"

You can create a new package via a "pending publisher"[1], which does not require a user-scoped token. (Note: even though PyPI calls them "user-scoped tokens," they have less access than a password does, since they can't manage the user's account itself. So, while not ideal, they are still a better choice than a user/pass combination.) [1]: https://docs.pypi.org/trusted-publishers/creating-a-project-through-oidc/ https://docs.pypi.org/trusted-publishers/creating-a-project-...