RFE: Support Token Scoping
Open
@aKlimau is already working on this.
Since Sep 16, 2026.
Feature
Triage-Needed
- Dominant language
- Python
- Stars
- 1
- Forks
- 4
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 6
Description
It might make sense to support "token scoping" such that API tokens are model - only capable of individual actions like push, yank, etc. This makes sense when you want to hand out a lower degree of access.
Can be deferred though, not an immediate concern.
Add scope fields to CargoToken:
distributions— M2M toRustDistribution(empty = all the user has access to)actions— JSON list of allowed actions (["publish", "yank"], empty = all)
This mirrors crates.io's RFC 2947 token scoping.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.