codekingpro/portable-devtools

1.TH "NPM-TOKEN" "1" "April 2026" "NPM@11.13.0" ""
2.SH "NAME"
3\fBnpm-token\fR - Manage your authentication tokens
4.SS "Synopsis"
5.P
6.RS 2
7.nf
8npm token list
9npm token revoke <id|token>
10npm token create
11.fi
12.RE
13.P
14Note: This command is unaware of workspaces.
15.SS "Description"
16.P
17This lets you list, create and revoke authentication tokens.
18.SS "Listing tokens"
19.P
20When listing tokens, an abbreviated token will be displayed. For security purposes the full token is not displayed.
21.SS "Generating tokens"
22.P
23When generating tokens, you will be prompted you for your password and, if you have two-factor authentication enabled, an otp.
24.P
25Please refer to the \fBdocs website\fR \fI\(lahttps://docs.npmjs.com/creating-and-viewing-access-tokens\(ra\fR for more information on generating tokens for CI/CD.
26.SS "Revoking tokens"
27.P
28When revoking a token, you can use the full token (e.g. what you get back from \fBnpm token create\fR, or as can be found in an \fB.npmrc\fR file), or a truncated id. If the given truncated id is not distinct enough to differentiate between multiple existing tokens, you will need to use enough of the id to allow npm to distinguish between them. Full token ids can be found on the \fBnpm website\fR \fI\(lahttps://www.npmjs.com\(ra\fR, or in the \fB--parseable\fR or \fB--json\fR output of \fBnpm token list\fR. This command will NOT accept the truncated token found in the normal \fBnpm token list\fR output.
29.P
30A revoked token will immediately be removed from the registry and you will no longer be able to use it.
31.SS "Configuration"
32.SS "\fBname\fR"
33.RS 0
34.IP \(bu 4
35Default: null
36.IP \(bu 4
37Type: null or String
38.RE 0
39
40.P
41When creating a Granular Access Token with \fBnpm token create\fR, this sets the name/description for the token.
42.SS "\fBtoken-description\fR"
43.RS 0
44.IP \(bu 4
45Default: null
46.IP \(bu 4
47Type: null or String
48.RE 0
49
50.P
51Description text for the token when using \fBnpm token create\fR.
52.SS "\fBexpires\fR"
53.RS 0
54.IP \(bu 4
55Default: null
56.IP \(bu 4
57Type: null or Number
58.RE 0
59
60.P
61When creating a Granular Access Token with \fBnpm token create\fR, this sets the expiration in days. If not specified, the server will determine the default expiration.
62.SS "\fBpackages\fR"
63.RS 0
64.IP \(bu 4
65Default:
66.IP \(bu 4
67Type: null or String (can be set multiple times)
68.RE 0
69
70.P
71When creating a Granular Access Token with \fBnpm token create\fR, this limits the token access to specific packages.
72.SS "\fBpackages-all\fR"
73.RS 0
74.IP \(bu 4
75Default: false
76.IP \(bu 4
77Type: Boolean
78.RE 0
79
80.P
81When creating a Granular Access Token with \fBnpm token create\fR, grants the token access to all packages instead of limiting to specific packages.
82.SS "\fBscopes\fR"
83.RS 0
84.IP \(bu 4
85Default: null
86.IP \(bu 4
87Type: null or String (can be set multiple times)
88.RE 0
89
90.P
91When creating a Granular Access Token with \fBnpm token create\fR, this limits the token access to specific scopes. Provide a scope name (with or without @ prefix).
92.SS "\fBorgs\fR"
93.RS 0
94.IP \(bu 4
95Default: null
96.IP \(bu 4
97Type: null or String (can be set multiple times)
98.RE 0
99
100.P
101When creating a Granular Access Token with \fBnpm token create\fR, this limits the token access to specific organizations.
102.SS "\fBpackages-and-scopes-permission\fR"
103.RS 0
104.IP \(bu 4
105Default: null
106.IP \(bu 4
107Type: null, "read-only", "read-write", or "no-access"
108.RE 0
109
110.P
111When creating a Granular Access Token with \fBnpm token create\fR, sets the permission level for packages and scopes. Options are "read-only", "read-write", or "no-access".
112.SS "\fBorgs-permission\fR"
113.RS 0
114.IP \(bu 4
115Default: null
116.IP \(bu 4
117Type: null, "read-only", "read-write", or "no-access"
118.RE 0
119
120.P
121When creating a Granular Access Token with \fBnpm token create\fR, sets the permission level for organizations. Options are "read-only", "read-write", or "no-access".
122.SS "\fBcidr\fR"
123.RS 0
124.IP \(bu 4
125Default: null
126.IP \(bu 4
127Type: null or String (can be set multiple times)
128.RE 0
129
130.P
131This is a list of CIDR address to be used when configuring limited access tokens with the \fBnpm token create\fR command.
132.SS "\fBbypass-2fa\fR"
133.RS 0
134.IP \(bu 4
135Default: false
136.IP \(bu 4
137Type: Boolean
138.RE 0
139
140.P
141When creating a Granular Access Token with \fBnpm token create\fR, setting this to true will allow the token to bypass two-factor authentication. This is useful for automation and CI/CD workflows.
142.SS "\fBpassword\fR"
143.RS 0
144.IP \(bu 4
145Default: null
146.IP \(bu 4
147Type: null or String
148.RE 0
149
150.P
151Password for authentication. Can be provided via command line when creating tokens, though it's generally safer to be prompted for it.
152.SS "\fBregistry\fR"
153.RS 0
154.IP \(bu 4
155Default: "https://registry.npmjs.org/"
156.IP \(bu 4
157Type: URL
158.RE 0
159
160.P
161The base URL of the npm registry.
162.SS "\fBotp\fR"
163.RS 0
164.IP \(bu 4
165Default: null
166.IP \(bu 4
167Type: null or String
168.RE 0
169
170.P
171This is a one-time password from a two-factor authenticator. It's needed when publishing or changing package permissions with \fBnpm access\fR.
172.P
173If not set, and a registry response fails with a challenge for a one-time password, npm will prompt on the command line for one.
174.SS "\fBread-only\fR"
175.RS 0
176.IP \(bu 4
177Default: false
178.IP \(bu 4
179Type: Boolean
180.RE 0
181
182.P
183This is used to mark a token as unable to publish when configuring limited access tokens with the \fBnpm token create\fR command.
184.SS "See Also"
185.RS 0
186.IP \(bu 4
187npm help adduser
188.IP \(bu 4
189npm help registry
190.IP \(bu 4
191npm help config
192.IP \(bu 4
193npm help npmrc
194.IP \(bu 4
195npm help owner
196.IP \(bu 4
197npm help whoami
198.IP \(bu 4
199npm help profile
200.RE 0
201