Applying Trusted Publisher

Nobody has claimed this yet.

Applying Trusted Publisher to your PyPI projects is strongly recommended for the following reasons:

- **Improved usability**: Eliminates the manual creation and management of long-lived API tokens by leveraging OpenID Connect (OIDC) in your CI workflows, streamlining release automation and reducing human error in token handling .
- **Enhanced security**: Short-lived tokens (valid for a maximum of 15 minutes) drastically limit the attack window for credential theft, mitigating the risk of token leakage or unauthorized reuse
- **Elimination of secret storage**: You no longer need to store sensitive API tokens in environment variables or secret managers; OIDC tokens are issued on-demand and never persist beyond the publish operation
- **Fine-grained trust controls**: Configure which CI workflows or environments are allowed to publish, enabling least-privilege release setups and reducing the blast radius of any compromised workflow
- **Automatic token revocation**: Since tokens expire automatically, there is no need for manual revocation, ensuring that stale credentials cannot be exploited long after they were issued .

https://docs.pypi.org/trusted-publishers/

Review the repository's CI release workflow and the linked PyPI Trusted Publishers documentation first. The work is done when publishing uses short-lived OIDC credentials with the intended trust controls and no long-lived PyPI API token is required.

Written by the indexing model from the issue text.