PyPI API Tokens and CI/CD Pipeline Credential Lifecycle

PyPI implements scoped API tokens to facilitate least-privilege access, allowing automated tools like twine to upload packages to specific projects without requiring global account credentials. This mechanism reduces the impact of a credential leak by limiting the token's scope to a subset of the user's projects.

While tokens can be manually revoked via the account interface to invalidate active sessions, there is no native server-side configuration for automatic expiration dates or Time-to-Live (TTL) settings for these tokens. This creates a dependency on external secret management systems or manual rotation schedules to prevent long-lived credentials from persisting indefinitely in CI/CD environments.

• What is the recommended strategy for implementing automated token rotation when PyPI does not provide native expiration dates?
• Are there documented methods to programmatically audit token usage to identify stale credentials for revocation?