Comment by tyingq

OpenVSX does have an option to use OIDC instead of a long lived token for publishing. I get the feeling a lot of people use the forever-good-unless-revoked token though.

https://news.ycombinator.com/item?id=50304129