Getting Started

DRANK

"Trusted Publishing" is our term for using the OpenID Connect (OIDC) standard to exchange short-lived identity tokens between a trusted third-party service and PyPI. This method can be used in automated environments and eliminates the need to use manually generated API tokens to authenticate with PyPI when publishing.For a quickstart, see:OpenID Connect (OIDC) publishing is a mechanism for uploading packages to PyPI, complementing API tokens.You don't need to understand OIDC to use OIDC publishing with PyPI, but here's the TL;DR:Certain CI services (like GitHub Actions) are OIDC identity providers, meaning that they can issue short-lived credentials ("OIDC tokens") that a third party can strongly verify came from the CI service (as well as which user, repository, etc. actually executed);Projects on PyPI can be configured to trust a particular configuration on a particular CI service, making that configuration an OIDC publisher for that project;Release automation (like GitHub Actions) …