PyPI tokens are very powerful, as that they are based on Macaroons_. They allow the bearer to add additional restrictions to an existing token. For example, given a PyPI token that can upload releases for any project of its owner, you can generate a token that will only allow some projects, or even a single one.

.. _macaroons: https://en.wikipedia.org/wiki/Macaroons_(computer_science)

Here's an example:

.. code-block:: console

$ pip install pypitoken

.. code-block:: python

import pypitoken

token = pypitoken.Token.load("pypi-foobartoken")

print(token.restrictions)
# [ProjectIDsRestriction(project_ids=["00000000-0000-0000-0000-000000000000"])]

token.restrict(project_names=["requests"])

print(token.restrictions)
# [
#     ProjectIDsRestriction(project_ids=["00000000-0000-0000-0000-000000000000"]),
#     ProjectNamesRestriction(project_names=["requests"]),
# ]

token.dump()
# pypi-newfoobartoken

This token we've created above will be restricted to uploading releases of requests. Of course, your PyPI user will still need to have upload permissions on requests for this to happen.

The aim of this library is to provide a simple toolbelt for manipulating PyPI tokens. Ideally, someday, PyPI (Warehouse_) itself may generate their tokens using this library too. This should make it easier to iterate on new kinds of restrictions for PyPI tokens, such as those discussed in the original implementation issue__.

.. _Warehouse: https://github.com/pypa/warehouse/ .. __: https://github.com/pypa/warehouse/issues/994

A discussion for integrating this library to the Warehouse environment is ongoing:

In the Python Packaging discussions_ for putting the project under the PyPA umbrella
In the Warehouse tracker_ for replacing the current macaroon implementation with this lib

.. _Python Packaging discussions: https://discuss.python.org/t/pypitoken-a-library-for-generating-and-manipulating-pypi-tokens/7572 .. _Warehouse tracker: https://github.com/pypa/warehouse/issues/9184

.. Below this line is content specific to the README that will not appear in the doc. .. end-of-index-doc

Where to go from here

The complete docs_ is probably the best place to learn about the project.

If you encounter a bug, or want to get in touch, you're always welcome to open a ticket_.

.. _docs: http://pypitoken.readthedocs.io/en/latest .. _ticket: https://github.com/ewjoachim/pypitoken/issues/new

Keywords

FAQs

What is pypitoken?

Is pypitoken well maintained?

Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install