To quote the blog post https://pyfound.blogspot.com/2019/06/pypi-now-supports-two-factor-login-via.... :

To further increase the security of Python package downloads, we're adding a new beta feature to the Python Package Index: WebAuthn support for U2F compatible hardware security keys as a two-factor authentication (2FA) login security method. This is thanks to a grant from the Open Technology Fund, coordinated by the Packaging Working Group of the Python Software Foundation.

...

Starting today, PyPI also supports (in beta) WebAuthn (U2F compatible) security keys for a second login factor. A security key (also known as a universal second factor, or U2F compatible key) is hardware device that communicates via USB, NFC, or Bluetooth. Popular keys include Yubikey, Google Titan and Thetis. PyPI supports any FIDO U2F compatible key and follows the WebAuthn standard. Users who have set up this second factor will be prompted to use their key (usually by inserting it into a USB port and pressing a button) when logging in. (This feature requires JavaScript.)

We need your help testing this while it's in beta: https://wiki.python.org/psf/WarehousePackageMaintainerTesting Later this week I'll publicize it to some more communities, and then in maybe 10 days, assuming we can quickly fix all the urgent bugs we find, we'll remove the "beta" badge. During this testing period, if things go awry, there's a chance we will need to wipe tokens from users' accounts, so if you choose to try it, please be forewarned. That's why you have to have a PyPI-verified email address on your user account before trying the feature, to make potential account recovery smoother. Thanks to the Open Technology Fund for funding this work. More progress reports at the Packaging Working Group's wiki page: https://wiki.python.org/psf/PackagingWG . (cross-posted to https://discuss.python.org/t/pypi-security-work-multifactor-auth-progress-he... ) -- Sumana Harihareswara Changeset Consulting https://changeset.nyc