codekingpro/portable-devtools

1.TH "NPM-TRUST" "1" "April 2026" "NPM@11.13.0" ""
2.SH "NAME"
3\fBnpm-trust\fR - Manage trusted publishing relationships between packages and CI/CD providers
4.SS "Synopsis"
5.P
6Note: This command is unaware of workspaces.
7.SS "Prerequisites"
8.P
9Before using npm trust commands, ensure the following requirements are met:
10.RS 0
11.IP \(bu 4
12\fBnpm version\fR: \fBnpm@11.10.0\fR or above is required. Use \fBnpm install -g npm@^11.10.0\fR to update if needed.
13.IP \(bu 4
14\fBWrite permissions on the package\fR: You must have write access to the package you're configuring.
15.IP \(bu 4
16\fB2FA enabled on account\fR: Two-factor authentication must be enabled at the account level. Even if it's not currently enabled, you must enable it to use trust commands.
17.IP \(bu 4
18\fBSupported authentication methods\fR: Granular Access Tokens (GAT) with the bypass 2FA option are not supported. Legacy basic auth (username and password) credentials will not work for trust commands or endpoints.
19.IP \(bu 4
20\fBPackage must exist\fR: The package you're configuring must already exist on the npm registry.
21.RE 0
22
23.SS "Description"
24.P
25Configure trust relationships between npm packages and CI/CD providers using OpenID Connect (OIDC). This is the command-line equivalent of managing trusted publisher configurations on the npm website.
26.P
27For a comprehensive overview of trusted publishing, see the \fBnpm trusted publishers documentation\fR \fI\(lahttps://docs.npmjs.com/trusted-publishers\(ra\fR.
28.P
29The \fB\[lB]package\[rB]\fR argument specifies the package name. If omitted, npm will use the name from the \fBpackage.json\fR in the current directory.
30.P
31Each trust relationship has its own set of configuration options and flags based on the OIDC claims provided by that provider. OIDC claims come from the CI/CD provider and include information such as repository name, workflow file, or environment. Since each provider's claims differ, the available flags and configuration keys are not universal\[em]npm matches the claims supported by each provider's OIDC configuration. For specific details on which claims and flags are supported for a given provider, use \fBnpm trust <provider> --help\fR.
32.P
33The required options depend on the CI/CD provider you're configuring. Detailed information about each option is available in the \fBmanaging trusted publisher configurations\fR \fI\(lahttps://docs.npmjs.com/trusted-publishers#managing-trusted-publisher-configurations\(ra\fR section of the npm documentation. If a provider is repository-based and the option is not provided, npm will use the \fBrepository.url\fR field from your \fBpackage.json\fR, if available.
34.P
35Currently, the registry only supports one configuration per package. If you attempt to create a new trust relationship when one already exists, it will result in an error. To replace an existing configuration:
36.RS 0
37.IP 1. 4
38Use \fBnpm trust list \[lB]package\[rB]\fR to view the ID of the existing trusted publisher
39.IP 2. 4
40Use \fBnpm trust revoke --id <id> \[lB]package\[rB]\fR to remove the existing configuration
41.IP 3. 4
42Then create your new trust relationship
43.RE 0
44
45.SS "Bulk Usage"
46.P
47For maintainers managing a large number of packages, you can configure trusted publishing in bulk using bash scripting. Create a loop that iterates through package names and their corresponding configuration details, executing the \fBnpm trust <provider>\fR command with the \fB--yes\fR flag for each package.
48.P
49The first request will require two-factor authentication. During two-factor authentication, you'll see an option on the npm website to skip two-factor authentication for the next 5 minutes. Enabling this option will allow subsequent \fBnpm trust <provider>\fR commands to proceed without two-factor authentication, streamlining the bulk configuration process.
50.P
51We recommend adding a 2-second sleep between each call to avoid rate limiting. With this approach, you can configure approximately 80 packages within the 5-minute two-factor authentication skip window.
52.SS "Configuration"
53.SS "\fBnpm trust github\fR"
54.P
55Create a trusted relationship between a package and GitHub Actions
56.SS "Synopsis"
57.P
58.RS 2
59.nf
60npm trust github \[lB]package\[rB] --file \[lB]--repo|--repository\[rB] \[lB]--env|--environment\[rB] \[lB]-y|--yes\[rB]
61.fi
62.RE
63.SS "Flags"
64.P
65| Flag | Default | Type | Description | | --- | --- | --- | --- | | \fB--file\fR | null | String (required) | Name of workflow file within a repositories .GitHub folder (must end in yaml, yml) | | \fB--repository\fR, \fB--repo\fR | null | String | Name of the repository in the format owner/repo | | \fB--environment\fR, \fB--env\fR | null | String | CI environment name | | \fB--dry-run\fR | false | Boolean | Indicates that you don't want npm to make any changes and that it should only report what it would have done. This can be passed into any of the commands that modify your local installation, eg, \fBinstall\fR, \fBupdate\fR, \fBdedupe\fR, \fBuninstall\fR, as well as \fBpack\fR and \fBpublish\fR. Note: This is NOT honored by other network related commands, eg \fBdist-tags\fR, \fBowner\fR, etc. | | \fB--json\fR | false | Boolean | Whether or not to output JSON data, rather than the normal output. * In \fBnpm pkg set\fR it enables parsing set values with JSON.parse() before saving them to your \fBpackage.json\fR. Not supported by all npm commands. | | \fB--registry\fR | "https://registry.npmjs.org/" | URL | The base URL of the npm registry. | | \fB--yes\fR, \fB-y\fR | null | null or Boolean | Automatically answer "yes" to any prompts that npm might print on the command line. |
66.SS "\fBnpm trust gitlab\fR"
67.P
68Create a trusted relationship between a package and GitLab CI/CD
69.SS "Synopsis"
70.P
71.RS 2
72.nf
73npm trust gitlab \[lB]package\[rB] --file \[lB]--project|--repo|--repository\[rB] \[lB]--env|--environment\[rB] \[lB]-y|--yes\[rB]
74.fi
75.RE
76.SS "Flags"
77.P
78| Flag | Default | Type | Description | | --- | --- | --- | --- | | \fB--file\fR | null | String (required) | Name of pipeline file (e.g., .gitlab-ci.yml) | | \fB--project\fR | null | String | Name of the project in the format group/project or group/subgroup/project | | \fB--environment\fR, \fB--env\fR | null | String | CI environment name | | \fB--dry-run\fR | false | Boolean | Indicates that you don't want npm to make any changes and that it should only report what it would have done. This can be passed into any of the commands that modify your local installation, eg, \fBinstall\fR, \fBupdate\fR, \fBdedupe\fR, \fBuninstall\fR, as well as \fBpack\fR and \fBpublish\fR. Note: This is NOT honored by other network related commands, eg \fBdist-tags\fR, \fBowner\fR, etc. | | \fB--json\fR | false | Boolean | Whether or not to output JSON data, rather than the normal output. * In \fBnpm pkg set\fR it enables parsing set values with JSON.parse() before saving them to your \fBpackage.json\fR. Not supported by all npm commands. | | \fB--registry\fR | "https://registry.npmjs.org/" | URL | The base URL of the npm registry. | | \fB--yes\fR, \fB-y\fR | null | null or Boolean | Automatically answer "yes" to any prompts that npm might print on the command line. |
79.SS "\fBnpm trust circleci\fR"
80.P
81Create a trusted relationship between a package and CircleCI
82.SS "Synopsis"
83.P
84.RS 2
85.nf
86npm trust circleci \[lB]package\[rB] --org-id <uuid> --project-id <uuid> --pipeline-definition-id <uuid> --vcs-origin <origin> \[lB]--context-id <uuid>...\[rB] \[lB]-y|--yes\[rB]
87.fi
88.RE
89.SS "Flags"
90.P
91| Flag | Default | Type | Description | | --- | --- | --- | --- | | \fB--org-id\fR | null | String (required) | CircleCI organization UUID | | \fB--project-id\fR | null | String (required) | CircleCI project UUID | | \fB--pipeline-definition-id\fR | null | String (required) | CircleCI pipeline definition UUID | | \fB--vcs-origin\fR | null | String (required) | CircleCI repository origin in format 'provider/owner/repo' | | \fB--context-id\fR | null | null or String (can be set multiple times) | CircleCI context UUID to match | | \fB--dry-run\fR | false | Boolean | Indicates that you don't want npm to make any changes and that it should only report what it would have done. This can be passed into any of the commands that modify your local installation, eg, \fBinstall\fR, \fBupdate\fR, \fBdedupe\fR, \fBuninstall\fR, as well as \fBpack\fR and \fBpublish\fR. Note: This is NOT honored by other network related commands, eg \fBdist-tags\fR, \fBowner\fR, etc. | | \fB--json\fR | false | Boolean | Whether or not to output JSON data, rather than the normal output. * In \fBnpm pkg set\fR it enables parsing set values with JSON.parse() before saving them to your \fBpackage.json\fR. Not supported by all npm commands. | | \fB--registry\fR | "https://registry.npmjs.org/" | URL | The base URL of the npm registry. | | \fB--yes\fR, \fB-y\fR | null | null or Boolean | Automatically answer "yes" to any prompts that npm might print on the command line. |
92.SS "\fBnpm trust list\fR"
93.P
94List trusted relationships for a package
95.SS "Synopsis"
96.P
97.RS 2
98.nf
99npm trust list \[lB]package\[rB]
100.fi
101.RE
102.SS "Flags"
103.P
104| Flag | Default | Type | Description | | --- | --- | --- | --- | | \fB--json\fR | false | Boolean | Whether or not to output JSON data, rather than the normal output. * In \fBnpm pkg set\fR it enables parsing set values with JSON.parse() before saving them to your \fBpackage.json\fR. Not supported by all npm commands. | | \fB--registry\fR | "https://registry.npmjs.org/" | URL | The base URL of the npm registry. |
105.SS "\fBnpm trust revoke\fR"
106.P
107Revoke a trusted relationship for a package
108.SS "Synopsis"
109.P
110.RS 2
111.nf
112npm trust revoke \[lB]package\[rB] --id=<trust-id>
113.fi
114.RE
115.SS "Flags"
116.P
117| Flag | Default | Type | Description | | --- | --- | --- | --- | | \fB--id\fR | null | String (required) | ID of the trusted relationship to revoke | | \fB--dry-run\fR | false | Boolean | Indicates that you don't want npm to make any changes and that it should only report what it would have done. This can be passed into any of the commands that modify your local installation, eg, \fBinstall\fR, \fBupdate\fR, \fBdedupe\fR, \fBuninstall\fR, as well as \fBpack\fR and \fBpublish\fR. Note: This is NOT honored by other network related commands, eg \fBdist-tags\fR, \fBowner\fR, etc. | | \fB--registry\fR | "https://registry.npmjs.org/" | URL | The base URL of the npm registry. |
118.SS "See Also"
119.RS 0
120.IP \(bu 4
121npm help publish
122.IP \(bu 4
123npm help token
124.IP \(bu 4
125npm help access
126.IP \(bu 4
127npm help config
128.IP \(bu 4
129npm help registry
130.RE 0
131