# PEP 807: Index support for Trusted Publishing

**URL:** <https://discuss.python.org/t/pep-807-index-support-for-trusted-publishing/104027>\
**Category:** Standards\
**Created:** [September 29, 2025, 4:09pm UTC](https://discuss.python.org/t/pep-807-index-support-for-trusted-publishing/104027 "2025-09-29T16:09:23Z")\
**Posts on this page:** 1\
**Showing post:** 10

<div class="post-metadata">

**Author:** ![woodruffw](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/woodruffw/32/37228_2.png) [@woodruffw](https://discuss.python.org/u/woodruffw)\
**Post date:** [October 23, 2025, 5:14pm UTC](https://discuss.python.org/t/pep-807-index-support-for-trusted-publishing/104027/10 "2025-10-23T17:14:00Z")

</div>

That all makes sense to me! To spitball a design, what about this for the discovery response?

```python
{
   "audience-endpoint": "https://upload.example.com/_/oidc/audience",
   "token-mint-endpoint": "https://upload.example.com/_/oidc/mint-token",
   "features": ["single-use-token", "multi-use-token"],
   "default-features": ["multi-use-token"]
}

```

In the above case, the server would be advertising that it supports both single- and multi-use tokens, with multi-use being the default. Then, the token-minting request:

```python
{
   "token": "oidc-token",
   "features": ["single-use"]
}

```

…would change the default. The server would then gain a bit of complexity in terms of deconflicting feature requests, but that’s not too bad IMO.

---

_[View the full topic](https://discuss.python.org/t/pep-807-index-support-for-trusted-publishing/104027)._