Starting in 2024, PyPI will require all users to enable Two-Factor Authentication. This will consequently require all users to switch to either Trusted Publishers (preferred) or API tokens for package uploads. Read more: https://blog.pypi.org/posts/2023-05-25-securing-pypi-with-2fa/

Using a username + password pair for authentication against https://test.pypi.org/legacy/

Using a user-provided API token for authentication against https://upload.pypi.org/legacy/

Trusted Publishers allows publishing packages to PyPI from automated environments like GitHub Actions without needing to use username/password combinations or API tokens to authenticate with PyPI. Read more: https://docs.pypi.org/trusted-publishers