Hacker News Reader

Macaroons are also implemented and used by pypi.org's implementation named Warehouse:

https://warehouse.pypa.io/development/token-scanning.html

Also see:

https://pypitoken.readthedocs.io/en/latest/

Yes, although PyPI doesn't currently do much attenuation or delegation with them (this is largely my fault, since I didn't fully understand their power when picking them for the implementation).

That's been slowly changing, however -- as of a few months ago, PyPI issues slightly more compact API tokens that make better use of discrete caveats. They're also used on the Trusted Publishing[1] side to make the API token self-expiring.

[1]: https://docs.pypi.org/trusted-publishers/

Reply on news.ycombinator.com