Configuring two-factor authentication | npm Docs (2024)

Table of contents

You can enable two-factor authentication (2FA) on your npm user account to protect against unauthorized access to your account and packages, either by using a security-key or time-based one-time password (TOTP) from a mobile app.

Prerequisites

Before you enable 2FA on your npm user account, you must:

For more information on supported 2FA methods, see "About two-factor authentication".

Note: npm does not accept SMS (text-to-phone) as a 2FA method.

Configuring 2FA from the website

Enabling 2FA

  1. On the npm "Sign In" page, enter your account details and click Sign In.Configuring two-factor authentication | npm Docs (1)
  2. In the upper right corner of the page, click your profile picture, then click Account.Configuring two-factor authentication | npm Docs (2)
  3. On the account settings page, under "Two-Factor Authentication", click Enable 2FA.

    Configuring two-factor authentication | npm Docs (3)
  4. When prompted provide your current account password and then click Confirm password to continue.

  5. On the 2FA method page, select the method you would like to enable and click Continue. For more information on supported 2FA methods, see "About two-factor authentication".

    Configuring two-factor authentication | npm Docs (4)
  6. Configure the 2FA method of your choice:

    • When using a security-key, provide a name for it and click Add security key. Follow the browser specific steps to add your security-key.
    Configuring two-factor authentication | npm Docs (5)
    • Below is an example of configuration from Microsoft Edge running on a MacOS
    Configuring two-factor authentication | npm Docs (6)
    • When using an authenticator application on your phone, open it and scan the QR code on the two-step verification page. Enter the code generated by the app, then click Verify.
    Configuring two-factor authentication | npm Docs (7)
  7. On the recovery code page, copy the recovery codes to your computer or other safe location that is not your second factor device. We recommend using a password manager.

    Configuring two-factor authentication | npm Docs (8)

    Recovery codes are the only way to ensure you can recover your account if you lose access to your second factor device. Each code can be used only once. You can view and regenerate your recovery code from your 2FA settings page. For secondary account recovery options, see "Configuring account recovery options."

  8. Click Go back to settings after confirming that you have saved your codes.

Disabling 2FA for writes

Check the Authorization and writes section for more information on different operations that requires 2FA when this mode is enabled.

Note: As a recommended setting, 2FA for write operations are automatically enabled when setting up 2FA. The following steps explain how to disable it.

  1. On the npm "Sign In" page, enter your account details and click Sign In.Configuring two-factor authentication | npm Docs (9)
  2. In the upper right corner of the page, click your profile picture, then click Account.Configuring two-factor authentication | npm Docs (10)
  3. On the account settings page, under "Two-Factor Authentication", click Modify 2FA.

    Configuring two-factor authentication | npm Docs (11)
  4. From the "Manage Two-Factor Authentication" navigate to "Additional Options" section

  5. Clear the checkbox for "Require two-factor authentication for write actions" and click "Update Preferences"

    Configuring two-factor authentication | npm Docs (12)

Disabling 2FA

If you have 2FA enabled, you can remove it from your account settings page.

Note: You cannot remove 2FA if you are a member of an organization that enforces 2FA. You can view the list of organizations memberships from your profile page under the "Organizations" tab.

  1. On the npm "Sign In" page, enter your account details and click Sign In.Configuring two-factor authentication | npm Docs (13)
  2. In the upper right corner of the page, click your profile picture, then click Account.Configuring two-factor authentication | npm Docs (14)
  3. On the account settings page, under "Two-Factor Authentication", click Modify 2FA.

    Configuring two-factor authentication | npm Docs (15)
  4. Scroll to the bottom of the "Manage Two-Factor Authentication" page and click Disable 2FA.

    Configuring two-factor authentication | npm Docs (16)
  5. Agree to the prompt from the browser.

Configuring 2FA from the command line

Enabling 2FA from the command line

Although security-key with WebAuthn can be used for authentication from both the web and the command line, it can only be configured from the web. When enabling 2FA from the command line, currently the only available option is to use an TOTP mobile app.

Note: Settings you configure on the command line will also apply to your profile settings on the npm website.

  1. If you are logged out on the command line, log in using npm login command.

  2. On the command line, type the npm profile command along with the option for the 2FA mode you want to enable:

    • To enable 2FA for authorization and writes, type:

      npm profile enable-2fa auth-and-writes
    • To enable 2FA for authorization only, type:

      npm profile enable-2fa auth-only
  3. To add npm to your authenticator application, using the device with the app, you can either:

    • Scan the QR code displayed on the command line.
    • Type the number displayed below the QR code.
  4. When prompted to add an OTP code from your authenticator, on the command line, enter a one-time password generated by your authenticator app.

Sending a one-time password from the command line

If you have enabled 2FA auth-and-writes, you will need to send the TOTP from the command line for certain commands to work. To do this, append --otp=123456 (where 123456 is the code generated by your authenticator) at the end of the command. Here are a few examples:

npm publish [<tarball>|<folder>][--tag <tag>] --otp=123456

npm owner add <user > --otp=123456

npm owner rm <user> --otp=123456

npm dist-tags add <pkg>@<version> [<tag>] --otp=123456

npm access edit [<package>) --otp=123456

npm unpublish [<@scope>/]<pkg>[@<version>] --otp=123456

Removing 2FA from the command line

  1. If you are logged out on the command line, log in using npm login command.

  2. On the command line, type the following command:

    npm profile disable-2fa
  3. When prompted, enter your npm password:

    npm password:
  4. When prompted for a one-time password, enter a password from your authenticator app:

    Enter one-time password from your authenticator: 123456

Configuring account recovery options

When you enable 2FA on your npm user account, we strongly recommend you link your GitHub and/or Twitter accounts to your npm user account. In the event you lose access to your 2FA device and recovery codes, these linked accounts can be used to verify your identity and expedite the recovery of your npm account.

  1. On the npm "Sign In" page, enter your account details and click Sign In.Configuring two-factor authentication | npm Docs (17)
  2. In the upper right corner of the page, click your profile picture, then click Account.Configuring two-factor authentication | npm Docs (18)
  3. To link your GitHub account, on the account settings page, under "Linked Accounts & Recovery Option", click Link with GitHub.

    Configuring two-factor authentication | npm Docs (19)
  4. On the authorization page, verify all information looks correct. Then click Authorize npm account link.

  5. To link your Twitter account, on the account settings page, under "Linked Accounts & Recovery Option", click Link with Twitter.

    Configuring two-factor authentication | npm Docs (20)
  6. On the authorization page, verify all information looks correct. Then click Authorize app.

The Twitter or GitHub account is now linked to your npm account. To remove the link to either account, you can click the Remove button next to the account you want to remove from your npm account.

Resolving TOTP errors

If you are entering what seems to be a valid TOTP but you see an error, be sure that you are using the correct authenticator account. If you have multiple authenticator accounts, using an TOTP from the wrong account will cause an error.

Also, when you reset two-factor authentication after it has been disabled, the authenticator might create a second account with the same name. Please see the authenticator documentation to delete the old account.

Edit this page on GitHub

7 contributorsConfiguring two-factor authentication | npm Docs (21)cdoublevConfiguring two-factor authentication | npm Docs (22)lukekarrysConfiguring two-factor authentication | npm Docs (23)monishcmConfiguring two-factor authentication | npm Docs (24)b4mbooConfiguring two-factor authentication | npm Docs (25)coliffConfiguring two-factor authentication | npm Docs (26)MylesBorinsConfiguring two-factor authentication | npm Docs (27)ethomson

Last edited by cdoublev on August 13, 2024

Configuring two-factor authentication | npm Docs (2024)
Top Articles
Latest Posts
Recommended Articles
Article information

Author: Prof. Nancy Dach

Last Updated:

Views: 5348

Rating: 4.7 / 5 (77 voted)

Reviews: 84% of readers found this page helpful

Author information

Name: Prof. Nancy Dach

Birthday: 1993-08-23

Address: 569 Waelchi Ports, South Blainebury, LA 11589

Phone: +9958996486049

Job: Sales Manager

Hobby: Web surfing, Scuba diving, Mountaineering, Writing, Sailing, Dance, Blacksmithing

Introduction: My name is Prof. Nancy Dach, I am a lively, joyous, courageous, lovely, tender, charming, open person who loves writing and wants to share my knowledge and understanding with you.