# PyPI security work: multifactor auth progress & help needed

**URL:** <https://discuss.python.org/t/pypi-security-work-multifactor-auth-progress-help-needed/1042>\
**Category:** Packaging\
**Created:** [March 22, 2019, 6:39pm UTC](https://discuss.python.org/t/pypi-security-work-multifactor-auth-progress-help-needed/1042 "2019-03-22T18:39:08Z")\
**Posts on this page:** 1\
**Showing post:** 49

<div class="post-metadata">

**Author:** ![sumanah](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/sumanah/32/1722_2.png) [@sumanah](https://discuss.python.org/u/sumanah)\
**Post date:** [January 17, 2020, 11:54am UTC](https://discuss.python.org/t/pypi-security-work-multifactor-auth-progress-help-needed/1042/49 "2020-01-17T11:54:50Z")

</div>

**Summary** : API tokens and all our 2FA methods are out of beta!

The auth security features we worked on, funded by the Open Tech Fund – two-factor authentication methods and API tokens for upload – are now out of beta on PyPI!

If you maintain or own a project on the Python Package Index, you should start using these features. Click “help” on PyPI for instructions ([2FA](https://pypi.org/help/#twofa), [tokens](https://pypi.org/help/#apitoken)).

(These features are also available on Test PyPI.)

**Future** : In the future, PyPI will set and enforce a policy requiring users with two-factor authentication enabled to use API tokens to upload (rather than just their password, without a second factor). We do not yet know when we will make this policy change.

**Help us out** : We’d love your help refining and implementing related features & fixes:

- [2FA: “trust this device for 30 days” option](https://github.com/pypa/warehouse/issues/5867)
- [implement 2FA recovery codes](https://github.com/pypa/warehouse/issues/5800)
- [log failed authentication attempts for audit trail?](https://github.com/pypa/warehouse/issues/6447)
- [Expose ‘user’ scoped API tokens in project security history?](https://github.com/pypa/warehouse/issues/6441)
- [“login” or dry-run validity check for tokens](https://github.com/pypa/warehouse/issues/6407) (and “API to verify upload ability without actually uploading” #5865)
- [Project-scoped API tokens should be accessible from project settings](https://github.com/pypa/warehouse/issues/6263)
- [Fill API token form when user arrives from manage project page](https://github.com/pypa/warehouse/issues/6606)

[Thanks to the Open Technology Fund for funding this work.](https://www.opentech.fund/results/supported-projects/pypi-improvements/) And thanks to all the folks I’ve thanked earlier in this thread. 🙂

And [more donor-funded work is in progress on pip and PyPI](https://wiki.python.org/psf/PackagingWG); other threads will have progress reports & details.

---

_[View the full topic](https://discuss.python.org/t/pypi-security-work-multifactor-auth-progress-help-needed/1042)._