Skip to main content

pypi-token-client

pipeline status docs pypi supported python versions

Library and CLI tool for creating and managing PyPI project tokens.

Purpose

PyPI allows the creation of per-project tokens but doesn't currently have an API to do so. While integration with CI providers is planned, apparently there is no plan for an API that would allow one to create tokens from a local development machine.

This tool seeks to provide a client exposing this functionality anyway by whatever means necessary.

Operating principle

Because there is no API and I'm also too lazy to try and figure out the exact sequence of HTTP requests one would have to make to simulate what happens when requesting tokens on the PyPI website, for now this tool just uses Playwright to automate performing the necessary steps in an actual browser.

This might be overkill and brittle but it works for now 🤷

Installation

To install from PyPI:

pip3 install pypi-token-client

You'll also have to install the required Playwright browsers (currently just Chromium):

playwright install chromium

Command-line tool usage

To create a token yourtokenname for your PyPI project yourproject:

pypi-token-client create --project yourproject yourtokenname

There are more commands - please refer to the docs.

Usage as a library

Basic example script:

import asyncio
from os import getenv

from pypi_token_client import (
  async_pypi_token_client, SingleProject, PypiCredentials
)

credentials = PypiCredentials(getenv("PYPI_USER"), getenv("PYPI_PASS"))
assert credentials.username and credentials.password

async def main() -> str:
  async with async_pypi_token_client(credentials) as session:
      token = await session.create_token(
          "my token",
          SingleProject("my-project"),
      )
  return token

token = asyncio.run(main())

print(token)

More information

For more detailed usage information and the API reference, refer to the documentation.

License

MIT License, see LICENSE file.

Metadata

Release files for pypi-token-client 1.0.9

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for pypi-token-client 1.0.9
File Size Uploaded Provenance Actions
pypi_token_client-1.0.9.tar.gz 11.2 kB Without provenance Details for pypi_token_client-1.0.9.tar.gz

Release files / pypi_token_client-1.0.9.tar.gz

Download URL pypi_token_client-1.0.9.tar.gz
Size 11.2 kB
Tags Source
SHA-256 checksum
How to use checksums
0e7368df0bfbc90ef9a0ac68f47acb0de06955b66c2777245f67410fb6c2ceeb
BLAKE2b-256 checksum
How to use checksums
fc78b54db77024ca197eec8e24cfae8b8765a0f35a2503eec08fe54ff08f9173
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/4.0.2 CPython/3.11.1

Security for pypi-token-client 1.0.9

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page