codekingpro/portable-devtools

1---
2title: npm-token
3section: 1
4description: Manage your authentication tokens
5---
6
7### Synopsis
8
9```bash
10npm token list
11npm token revoke <id|token>
12npm token create
13```
14
15Note: This command is unaware of workspaces.
16
17### Description
18
19This lets you list, create and revoke authentication tokens.
20
21#### Listing tokens
22
23When listing tokens, an abbreviated token will be displayed.  For security purposes the full token is not displayed.
24
25#### Generating tokens
26
27When generating tokens, you will be prompted you for your password and, if you have two-factor authentication enabled, an otp.
28
29Please refer to the [docs website](https://docs.npmjs.com/creating-and-viewing-access-tokens) for more information on generating tokens for CI/CD.
30
31#### Revoking tokens
32
33When revoking a token, you can use the full token (e.g. what you get back from `npm token create`, or as can be found in an `.npmrc` file), or a truncated id.  If the given truncated id is not distinct enough to differentiate between multiple existing tokens, you will need to use enough of the id to allow npm to distinguish between them.  Full token ids can be found on the [npm website](https://www.npmjs.com), or in the `--parseable` or `--json` output of `npm token list`.  This command will NOT accept the truncated token found in the normal `npm token list` output.
34
35A revoked token will immediately be removed from the registry and you will no longer be able to use it.
36
37### Configuration
38
39#### `name`
40
41* Default: null
42* Type: null or String
43
44When creating a Granular Access Token with `npm token create`, this sets the
45name/description for the token.
46
47
48
49#### `token-description`
50
51* Default: null
52* Type: null or String
53
54Description text for the token when using `npm token create`.
55
56
57
58#### `expires`
59
60* Default: null
61* Type: null or Number
62
63When creating a Granular Access Token with `npm token create`, this sets the
64expiration in days. If not specified, the server will determine the default
65expiration.
66
67
68
69#### `packages`
70
71* Default:
72* Type: null or String (can be set multiple times)
73
74When creating a Granular Access Token with `npm token create`, this limits
75the token access to specific packages.
76
77
78
79#### `packages-all`
80
81* Default: false
82* Type: Boolean
83
84When creating a Granular Access Token with `npm token create`, grants the
85token access to all packages instead of limiting to specific packages.
86
87
88
89#### `scopes`
90
91* Default: null
92* Type: null or String (can be set multiple times)
93
94When creating a Granular Access Token with `npm token create`, this limits
95the token access to specific scopes. Provide a scope name (with or without @
96prefix).
97
98
99
100#### `orgs`
101
102* Default: null
103* Type: null or String (can be set multiple times)
104
105When creating a Granular Access Token with `npm token create`, this limits
106the token access to specific organizations.
107
108
109
110#### `packages-and-scopes-permission`
111
112* Default: null
113* Type: null, "read-only", "read-write", or "no-access"
114
115When creating a Granular Access Token with `npm token create`, sets the
116permission level for packages and scopes. Options are "read-only",
117"read-write", or "no-access".
118
119
120
121#### `orgs-permission`
122
123* Default: null
124* Type: null, "read-only", "read-write", or "no-access"
125
126When creating a Granular Access Token with `npm token create`, sets the
127permission level for organizations. Options are "read-only", "read-write",
128or "no-access".
129
130
131
132#### `cidr`
133
134* Default: null
135* Type: null or String (can be set multiple times)
136
137This is a list of CIDR address to be used when configuring limited access
138tokens with the `npm token create` command.
139
140
141
142#### `bypass-2fa`
143
144* Default: false
145* Type: Boolean
146
147When creating a Granular Access Token with `npm token create`, setting this
148to true will allow the token to bypass two-factor authentication. This is
149useful for automation and CI/CD workflows.
150
151
152
153#### `password`
154
155* Default: null
156* Type: null or String
157
158Password for authentication. Can be provided via command line when creating
159tokens, though it's generally safer to be prompted for it.
160
161
162
163#### `registry`
164
165* Default: "https://registry.npmjs.org/"
166* Type: URL
167
168The base URL of the npm registry.
169
170
171
172#### `otp`
173
174* Default: null
175* Type: null or String
176
177This is a one-time password from a two-factor authenticator. It's needed
178when publishing or changing package permissions with `npm access`.
179
180If not set, and a registry response fails with a challenge for a one-time
181password, npm will prompt on the command line for one.
182
183
184
185#### `read-only`
186
187* Default: false
188* Type: Boolean
189
190This is used to mark a token as unable to publish when configuring limited
191access tokens with the `npm token create` command.
192
193
194
195### See Also
196
197* [npm adduser](/commands/npm-adduser)
198* [npm registry](/using-npm/registry)
199* [npm config](/commands/npm-config)
200* [npmrc](/configuring-npm/npmrc)
201* [npm owner](/commands/npm-owner)
202* [npm whoami](/commands/npm-whoami)
203* [npm profile](/commands/npm-profile)
204