[docs] Documentation changes for Dec 9 release (#1777)
This PR includes documentation changes for upcoming release on Dec 9. - Removing legacy token section Co-authored-by: sam crochet <shmam@github.com>
Karen Li committed
Dec 9, 2025 at 11:58 UTC
d05aa16e974c73559e8ce85bb5a47f6949e9f125
1 file changed
-19
content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx
-19
@@ -22,30 +22,11 @@ You can work with tokens from the web or the CLI, whichever is easiest. What you
22
npm token commands let you:
23
24
- View tokens for easier tracking and management
25
-- Create new legacy tokens (deprecated)
25
- Limit access according to IP address ranges (CIDR)
26
- Delete/revoke tokens
27
28
For more information on creating and viewing access tokens on the web and CLI, see "[Creating and viewing access tokens][create-token]".
29
31
-## About legacy tokens (Deprecated)
32
-
33
-<Note variant="danger">
34
-
35
-**Warning:** Legacy access tokens were removed on November 5, 2025.
36
-
37
-</Note>
38
-
39
-Legacy tokens are created with the same permissions as the user who created them. The npm CLI automatically generates and uses a publish token when you run `npm login`.
40
-
41
-There are three different types of legacy tokens:
42
-
43
-- **Read-only**: You can use these tokens to download packages from the registry. These tokens are best for automation and workflows where you are installing packages. For greater security, we recommend using [granular access tokens](#about-granular-access-tokens) instead.
44
-- **Automation**: You can use these tokens to download packages and install new ones. These tokens are best for automation workflows where you are publishing new packages. Automation tokens do not require 2FA for executing operations on npm and are suitable for CI/CD workflows. For greater security, we recommend using [granular access tokens](#about-granular-access-tokens) instead.
45
-- **Publish**: You can use these tokens to download packages, install packages, and update user and package settings. We recommend using them for interactive workflows such as a CLI. If 2FA is enabled on your account, publish tokens will require 2FA to execute sensitive operations on npm.
46
-
47
-Legacy tokens do not have an expiration date. It is important to be aware of your tokens and keep them protected for account security. For more information, see "[Securing your token][secure-token]."
48
-
30
## About granular access tokens
31
32
Granular access tokens allow you to restrict access provided to the token based on what you want to use the token for. With granular access tokens, you can: