About two-factor authentication
Two-factor authentication (2FA) protects against unauthorized access to your account by confirming your identity using:
- something you know (such as your username and password)
- something you have (such as a phone or tablet)
When you enable 2FA, we will prompt you for a unique one-time password when you perform certain actions on your account or on packages to which you have write access, depending on your 2FA configuration.
Note: Two-factor authentication provides the best possible security for your account against attackers. We strongly recommend enabling 2FA on your account as soon as possible after you sign up.
Two-factor authentication modes on npm
Two-factor authentication on npm can be enabled for authorization only, or authorization and writes.
Authorization only
If you enable 2FA for authorization only, we will request a one-time password for certain authorized actions.
| Action | CLI command |
|---|---|
| Log in to npm | npm login |
| Change profile settings (including your password) | npm profile set |
| Change 2FA modes for your user account | npm profile enable-2fa auth-only |
| Disable 2FA for your user account | npm profile disable-2fa |
Authorization and writes
If you enable 2FA for authorization and writes, we will request a one-time password for certain authorized actions, as well as write actions.
| Action | CLI command |
|---|---|
| Log in to npm | npm login |
| Change profile settings (including your password) | npm profile set |
| Change 2FA modes for your user account | npm profile enable-2fa auth-and-writes |
| Disable 2FA for your user account | npm profile disable-2fa |
| Create tokens | npm token create |
| Revoke tokens | npm token revoke |
| Publish packages | npm publish |
| Unpublish packages | npm unpublish |
| Deprecate packages | npm deprecate |
| Change package visibility | npm access public/restricted |
| Change user and team package access | npm access grant/revoke |
| Change package 2FA requirements | npm access 2fa-required/2fa-not-required |
© npm, Inc. and Contributors
Licensed under the npm License.
npm is a trademark of npm, Inc.
https://docs.npmjs.com/about-two-factor-authentication