@cryptotaxi247 / documentation-1
Code Commits Issues Pulls Sessions CI/CD
main
@reggi/path-to-regexp dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2 dependabot/npm_and_yarn/main/eslint-10.4.0 dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0 dependabot/npm_and_yarn/main/proc-log-7.0.0 dependabot/npm_and_yarn/npm_and_yarn-826852524d dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2 deprecate-totp-2fa dhei/classic-tokens gat-bypass-2fa-docs jpg619/fix-accessibility-content-flow jpg619/version-bump-tar-2 kartykp/gat-bypass-2fa-docs kartykp/upgrade-path-to-regex main maitxn/version-bump-tar patch-1 reggi/cache-based-on-version reggi/dev-engines reggi/fix-transform-prettier reggi/overrides update-search-sensitivity
mdx 88 lines 5.51 KB
Raw
1 ---
2 title: About two-factor authentication
3 redirect_from:
4 - /getting-started/using-two-factor-authentication
5 ---
6
7 [Two-factor authentication (2FA)][2fa] protects against unauthorized access to your account by confirming your identity using:
8
9 - Something you know (e.g., a password).
10 - Something you have (e.g., an ID badge or a cryptographic key).
11 - Something you are (e.g., a fingerprint or other biometric data).
12
13 When you enable 2FA, you will be prompted for a second form of authentication before performing certain actions on your account or packages to which you have write access. You will be prompted to authenticate with a [security-key][webauthn].
14
15 - The security-key flow allows you to use biometric devices such as Apple [Touch ID][touch-id], [Face ID][face-id] or [Windows Hello][windows-hello] as well as physical keys such as [Yubikey][yubikey], [Thetis][thetis] or [Feitian][feitian] as your 2FA.
16
17 <Note>
18
19 **Note:** Two-factor authentication provides the best possible security for your account against attackers. We strongly recommend enabling 2FA on your account as soon as possible after you sign up.
20
21 </Note>
22
23 <Note variant="warning">
24
25 **Important:** Publishing to npm requires either:
26
27 - Two-factor authentication (2FA) enabled on your account, OR
28 - A granular access token with bypass 2FA enabled
29
30 For more information, see the npm documentation on [requiring 2FA for package publishing](/requiring-2fa-for-package-publishing-and-settings-modification).
31
32 </Note>
33
34 ## Two-factor authentication on npm
35
36 Two-factor authentication on npm can be enabled for authorization and writes, or authorization only.
37
38 ### Authorization and writes
39
40 By default, 2FA is enabled for authorization and writes. We will request a second form of authentication for certain authorized actions, as well as write actions.
41
42 <DataTable
43 headers={["Action", "CLI command"]}
44 align={["l", "l"]}
45 rows={[
46 ["Log in to npm", <Link key="login" href="https://docs.npmjs.com/cli/adduser"><InlineCode>npm login</InlineCode></Link>],
47 ["Change profile settings (including your password)", <Link key="profile-set" href="https://docs.npmjs.com/cli/profile"><InlineCode>npm profile set</InlineCode></Link>],
48 ["Change 2FA modes for your user account", <Link key="2fa-enable" href="https://docs.npmjs.com/cli/profile"><InlineCode>npm profile enable-2fa auth-and-writes</InlineCode></Link>],
49 ["Disable 2FA for your user account", <Link key="2fa-disable" href="https://docs.npmjs.com/cli/profile"><InlineCode>npm profile disable-2fa</InlineCode></Link>],
50 ["Create tokens", <Link key="token-create" href="https://docs.npmjs.com/cli/token"><InlineCode>npm token create</InlineCode></Link>],
51 ["Revoke tokens", <Link key="token-revoke" href="https://docs.npmjs.com/cli/token"><InlineCode>npm token revoke</InlineCode></Link>],
52 ["Publish packages", <Link key="publish" href="https://docs.npmjs.com/cli/publish"><InlineCode>npm publish</InlineCode></Link>],
53 ["Unpublish packages", <Link key="unpublish" href="https://docs.npmjs.com/cli/unpublish"><InlineCode>npm unpublish</InlineCode></Link>],
54 ["Deprecate packages", <Link key="deprecate" href="https://docs.npmjs.com/cli/deprecate"><InlineCode>npm deprecate</InlineCode></Link>],
55 ["Change package visibility", <Link key="access-visibility" href="https://docs.npmjs.com/cli/access"><InlineCode>npm access public/restricted</InlineCode></Link>],
56 ["Change user and team package access", <Link key="access-grant" href="https://docs.npmjs.com/cli/access"><InlineCode>npm access grant/revoke</InlineCode></Link>],
57 [<Link key="pkg-2fa" href="/requiring-2fa-for-package-publishing-and-settings-modification">Change package 2FA requirements</Link>, <Link key="access-2fa" href="https://docs.npmjs.com/cli/access"><InlineCode>npm access 2fa-required/2fa-not-required</InlineCode></Link>]
58 ]}
59 />
60
61 ### Authorization only
62
63 If you enable 2FA for authorization only. We will request a second form of authentication only for certain authorized actions.
64
65 <DataTable
66 headers={["Action", "CLI command"]}
67 align={["l", "l"]}
68 rows={[
69 ["Log in to npm", <Link key="login" href="https://docs.npmjs.com/cli/adduser"><InlineCode>npm login</InlineCode></Link>],
70 ["Change profile settings (including your password)", <Link key="profile-set" href="https://docs.npmjs.com/cli/profile"><InlineCode>npm profile set</InlineCode></Link>],
71 ["Change 2FA modes for your user account", <Link key="2fa-enable" href="https://docs.npmjs.com/cli/profile"><InlineCode>npm profile enable-2fa auth-only</InlineCode></Link>],
72 ["Disable 2FA for your user account", <Link key="2fa-disable" href="https://docs.npmjs.com/cli/profile"><InlineCode>npm profile disable-2fa</InlineCode></Link>],
73 ["Create tokens", <Link key="token-create" href="https://docs.npmjs.com/cli/token"><InlineCode>npm token create</InlineCode></Link>],
74 ["Revoke tokens", <Link key="token-revoke" href="https://docs.npmjs.com/cli/token"><InlineCode>npm token revoke</InlineCode></Link>]
75 ]}
76 />
77
78 [webauthn]: https://webauthn.guide/
79 [can-i-use]: https://caniuse.com/#search=webauthn
80 [u2f]: https://en.wikipedia.org/wiki/Universal_2nd_Factor
81 [windows-hello]: https://support.microsoft.com/en-us/windows/learn-about-windows-hello-and-set-it-up-dae28983-8242-bb2a-d3d1-87c9d265a5f0
82 [touch-id]: https://support.apple.com/en-gb/HT204587
83 [face-id]: https://support.apple.com/en-us/HT208108
84 [yubikey]: https://www.yubico.com/
85 [thetis]: https://thetis.io/
86 [feitian]: https://www.ftsafe.com/
87 [totp]: https://en.wikipedia.org/wiki/Time-based_one-time_password
88 [2fa]: https://en.wikipedia.org/wiki/Multi-factor_authentication