@@ -5,41 +5,44 @@ author: Tobias Bieniek
5
5
team : the crates.io team <https://www.rust-lang.org/governance/teams/crates-io>
6
6
---
7
7
8
- If you created a new API token on crates.io lately, you may have noticed our new
9
- API token creation page and some of the new features it supports.
10
-
11
- Previously, when you clicked the "New Token" button on < https://crates.io/settings/tokens >
12
- you would only get the option to choose a name for the token, but nothing else.
13
- We knew that we wanted to offer our users more choices, but in the previous user
14
- interface that would have been difficult, so our first step was to build a
15
- proper "New API Token" page.
16
-
17
- Our next two features on the to-do list were both described as "token scopes".
18
- One part is allowing you to restrict API tokens to certain operations, e.g.
19
- only allowing a token to publish new versions of existing crates, but not any
20
- new crates. The second part is an optional restriction for the token to only
21
- work with certain crate names. If you want to read more about how these features
8
+ If you recently generated a new API token on crates.io, you might have noticed
9
+ our new API token creation page and some of the new features it now supports.
10
+
11
+ Previously, when clicking the "New Token" button on < https://crates.io/settings/tokens > ,
12
+ you were only provided with the option to choose a token name, without any
13
+ additional choices. We knew that we wanted to offer our users more flexibility,
14
+ but in the previous user interface that would have been difficult, so our first
15
+ step was to build a proper "New API Token" page.
16
+
17
+ Our roadmap included two essential features known as "token scopes". The first
18
+ of them allows you to restrict API tokens to specific operations. For instance,
19
+ you can configure a token to solely enable the publishing of new versions for
20
+ existing crates, while disallowing the creation of new crates. The second one
21
+ offers an optional restriction where tokens can be limited to only work for
22
+ specific crate names. If you want to read more about how these features
22
23
were planned and implemented you can take a look at our corresponding
23
24
[ tracking issue] ( https://github.com/rust-lang/crates.io/issues/5443 ) .
24
25
25
- The remaining piece to making crates.io API tokens more secure was implementing
26
- expiration dates for them . Since we had already touched most of the
27
- token-related code this was relatively straight-forward, and we are happy to
26
+ To further enhance the security of crates.io API tokens, we prioritized the
27
+ implementation of expiration dates . Since we had already touched most of the
28
+ token-related code this was relatively straight-forward. We are delighted to
28
29
announce that our "New API Token" page now supports endpoint scopes, crate
29
30
scopes and expiration dates:
30
31
31
32
![ Screenshot of the "New API Token" page] ( /images/2023-06-23-improved-api-tokens-for-crates-io/new-api-token-page.png )
32
33
33
- Similar to when you create an API token on github.com, you can choose to not
34
- have an expiration date, use one of the presets, or even choose a custom
35
- expiration date.
34
+ Similar to the API token creation process on github.com, you can choose to not
35
+ have any expiration date, use one of the presets, or even choose a custom
36
+ expiration date to suit your requirements .
36
37
37
- If you notice any issues, or if you have any questions don't hesitate to find us
38
- on [ Zulip] ( https://rust-lang.zulipchat.com/#narrow/stream/318791-t-crates-io/topic/token.20scopes )
38
+ If you come across any issues or have questions, feel free to reach out to us on
39
+ [ Zulip] ( https://rust-lang.zulipchat.com/#narrow/stream/318791-t-crates-io/topic/token.20scopes )
39
40
or open an issue on [ GitHub] ( https://github.com/rust-lang/crates.io/issues/new/choose ) .
40
41
41
- Finally, the crates.io team would like to thank the [ OpenSSF's Alpha-Omega Initiative] ( https://openssf.org/community/alpha-omega/ )
42
+ Lastly, we, the crates.io team, would like to express our gratitude to the
43
+ [ OpenSSF's Alpha-Omega Initiative] ( https://openssf.org/community/alpha-omega/ )
42
44
and [ JFrog] ( https://jfrog.com/blog/jfrog-joins-rust-foundation-as-platinum-member/ )
43
- for funding the [ Rust Foundation] ( https://rustfoundation.org ) security
44
- initiative, which enabled us to implement these features and perform a lot of
45
- other security-related work on the crates.io codebase in the past couple of months!
45
+ for their contributions to the [ Rust Foundation] ( https://rustfoundation.org )
46
+ security initiative. Their support has been instrumental in enabling us to
47
+ implement these features and undertake extensive security-related work on the
48
+ crates.io codebase over the past few months.
0 commit comments