Project scoped. PyPI lets you create a token for an entire account or limit a token to a specific project, and its help page recommends keeping CI tokens to the minimum projects necessary. An account-wide token that leaks lets an attacker publish to every package you maintain.
The two scopes
| Scope | What a leaked token can do | When to use |
|---|---|---|
| Entire account | Upload to any project you can publish | Only to create the first project token |
| One project | Upload to that project only | Normal CI publishing |
A common pattern follows from this. Use the account-wide token once, to publish a new project for the first time, then create a project scoped token and delete the wide one.
Where tokens leak
- CI logs and debug output
- Shared environment variable files
- Developer laptops and old shell history
- Forks and pull request builds that expose secrets
PyPI notes that when a token linked to an account is posted on a public website, it is automatically revoked. Do not rely on that alone, because a token can leak somewhere that is not public.
A cleaner option: no long-lived token
Trusted publishing lets a CI system prove its identity and receive a short lived credential, so there is no secret to leak. If your CI supports it, it is the stronger choice. See PyPI trusted publisher setup with GitHub Actions. The Python Packaging User Guide recommends trusted publishing from supported platforms, with a manual upload tool as the fallback.
Steps to tighten what you have
- List every token on the account and where it is used.
- Delete any you cannot place.
- Replace account-wide tokens with one token per project.
- Store each in your CI secret store, scoped to the one repository and, where possible, one protected environment.
- Turn on two factor sign in for every maintainer.
- Switch to trusted publishing when you can, and delete the tokens afterward.
What to check after a suspected leak
Look at the release history of each project the token could reach. Any release you did not publish, or published at an odd hour, needs investigation. Compare file hashes with your build output. If you find a bad release, tell the PyPI administrators through the contact on the help page, and tell your users through your own channels with the affected version numbers.
Quick check
What if I think a token leaked?
Delete it in your account settings, create a scoped replacement, and check recent releases for anything you did not publish.
Is a project scoped token enough on its own?
It limits the damage but is still a long-lived secret. Trusted publishing avoids storing one.
Safeguard's secrets related policies and gates can block risky changes in a pull request, and a free scan is available.
Sources
Last reviewed: 19 October 2026.
