Support Access Tokens as Authentication Mechanism

[sigmavirus24]

PyPI now supports scoped access tokens, we should grow support for this as appropriate: https://discuss.python.org/t/pypi-security-work-multifactor-auth-progress-help-needed/1042/31

[di]

@sigmavirus24 This should "just work" without any changes to twine by using __token__ as the username and the token as the password. What additional support do you think twine needs here?

[sigmavirus24]

Ah, I hadn't gotten around to reading the link. I see that it should continue working. I was thinking we might need to add support for retrieving the token on behalf of users.

[almarklein]

by using @token as the username and the token as the password

Is this documented somewhere? The only thing I could find is this issue :D

[almarklein]

On https://pypi.org/manage/account/token/ it says the username is supposed to be __token__ btw.

[di]

@almarklein Yep, we changed it not long after the launch -- I'll edit that comment.

[di]

This is also documented here: https://pypi.org/help/#apitoken

[sorenwacker]

It doesn't seem to work though.

[di]

@soerendip Please file a new issue w/ all details and we'll try to help.