docs: clarify 2FA bypass behavior without security warnings
- Updated step 9 to use 'useful' instead of 'ideal' for CI/CD workflows - Clarified that unchecked means token respects account's normal 2FA settings - Removed security warning note per decision to keep documentation straightforward
Karthikeyan Padaikathu committed
Oct 28, 2025 at 18:12 UTC
f1ad23546bdbaa2c115359a3ce595691a81628c0
1 file changed
+2
-2
content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx
+2
-2
@@ -76,8 +76,8 @@ You can [create](#creating-access-tokens) and [view](#viewing-access-tokens) acc
76
_**Note**: When you give a token access to an organization, the token can only be used for managing organization settings and teams or users associated with the organization. It does not give the token the right to publish packages managed by the organization._
77
78
9. (Optional) In the **Two-Factor Authentication** section, configure whether the token can bypass 2FA requirements.
79
- - Check **Bypass two-factor authentication** to allow the token to bypass 2FA requirements when performing operations on npm. This is ideal for CI/CD workflows and automation scenarios.
80
- - Leave unchecked if you want the token to require 2FA for sensitive operations.
79
+ - Check **Bypass two-factor authentication** to allow the token to bypass 2FA requirements when performing operations on npm. This is useful for CI/CD workflows and automation scenarios.
80
+ - Leave unchecked if you want the token to respect your account's normal 2FA settings (token will not bypass 2FA).
81
82
10. Review the token summary, then click **Generate Token**.
83