能否实现PyPi认证令牌的自动定期轮换与重新生成？

As of right now, you’re correct—PyPI does not offer any programmatic or API-based way to generate or delete authentication tokens. All token management (creation, revocation, rotation) requires manual action through the web UI, including completing 2FA verification. There’s no official way to automate this process at present.

That said, there are several workarounds to reduce the overhead of manual rotation and improve your overall security posture:

• Use scoped, limited-permission tokens: Instead of a single global token, create tokens restricted to specific packages or only have upload permissions. This minimizes the impact if a token is compromised or needs rotation—you won’t have to update every pipeline when rotating one token. You can even create separate tokens for different CI/CD workflows.
• Implement structured rotation reminders: Since automation isn’t possible, set up calendar alerts or add comments to your CI/CD configuration files to flag when tokens are due for rotation (6–12 months). Pair this with a simple checklist to streamline the process:
  1. Generate a new scoped token via the PyPI web UI
  2. Update the token in your CI/CD secrets store (e.g., GitHub Secrets, GitLab Variables)
  3. Run a test pipeline to confirm the new token works
  4. Revoke the old token in the PyPI UI
• Switch to PyPI Trusted Publishers: This feature eliminates static tokens entirely by using short-lived, automatically generated tokens tied to your CI provider’s identity (like GitHub Actions or GitLab CI/CD). Each pipeline run authenticates directly with PyPI without needing a static token, so you never have to worry about rotation again. This is the most secure and low-maintenance option if your CI tool supports it.
• Centralize secrets with approval workflows: If you use a secrets manager (e.g., AWS Secrets Manager, HashiCorp Vault), you can set up automated reminders for token rotation that trigger a manual approval step. Once you update the token in the manager, all pipelines that pull from it will automatically use the new token—this keeps your secrets organized and tracks rotation history.

While PyPI may add API support for token management in the future, these workarounds are the best ways to handle token rotation securely and efficiently today.

内容的提问来源于stack exchange，提问作者artemdevel