[woodruffw]

PyPI’s existing API tokens are probably a better fit for your use case, and already support “self” publishing (since that’s the default; everything in this blog post is about delegating trust away).