IIt would be helpful if VRChat allowed users to generate a one-time avatar upload token that could be shared with an avatar creator. The creator could paste this token into the avatar's blueprint before uploading, and VRChat would automatically assign the uploaded avatar to the intended user's account.

This would eliminate the need for users to share their VRChat login credentials with avatar creators, which is currently one of the most common ways custom avatars are delivered.

For example, I have friends who know little to nothing about avatar creation, and I'd like to make avatars for them. However, because I've had security issues in the past, including account compromises originating through Discord, I'm not comfortable having someone else's login information stored or entered on my PC, even temporarily.

A one-time upload token would improve both security and convenience. The token could be limited to a single upload, expire after a short period of time, and only grant permission to upload an avatar to the user's account. It would not provide access to account settings, personal information, or any other account functions.

This would allow experienced creators to safely build and upload avatars for their friends and clients while preserving account security and reducing the need to share sensitive credentials.