Updated GAT restrictions (#671)
- 50 tokens to 1000 tokens - Remove max 365 days expiry Signed-off-by: Philip Harrison <philip@mailharrison.com>
Philip Harrison committed
Jul 11, 2023 at 17:38 UTC
f2c57df5940436a8671e05d972df71aa0a52025a
2 files changed
+13
-13
content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx
+3
-3
@@ -40,7 +40,7 @@ There are three different types of legacy tokens:
40
41
* **Read-only**: You can use these tokens to download packages from the registry. These tokens are best for automation and workflows where you are installing packages. For greater security, we recommend using [granular access tokens](#about-granular-access-tokens) instead.
42
* **Automation**: You can use these tokens to download packages and install new ones. These tokens are best for automation workflows where you are publishing new packages. Automation tokens do not 2FA for executing operations on npm and are suitable for CI/CD workflows. For greater security, we recommend using [granular access tokens](#about-granular-access-tokens) instead.
43
-* **Publish**: You can use these tokens to download packages, install packages, and update user and package settings. We recommend using them for interactive workflows such as a CLI. If 2FA is enabled on your account, publish tokens will require 2FA to execute sensitive operations on npm.
43
+* **Publish**: You can use these tokens to download packages, install packages, and update user and package settings. We recommend using them for interactive workflows such as a CLI. If 2FA is enabled on your account, publish tokens will require 2FA to execute sensitive operations on npm.
44
45
Legacy tokens do not have an expiration date. It is important to be aware of your tokens and keep them protected for account security. For more information, see "[Securing your token][secure-token]."
46
@@ -54,9 +54,9 @@ Granular access tokens allow you to restrict access provided to the token based
54
* Limit token access based on IP address ranges
55
* Select between **read-only** or **read and write** access
56
57
-You can create up to 50 granular access tokens on your npm account. You can set how long your token is valid for, up to a maximum expiration of 365 days from creation. Each token can access up to 50 organizations, and up to either 50 packages, 50 scopes, or a combination of 50 packages and scopes. Access tokens are tied to users’ permission; hence it cannot have more permission than the user at any point in time. If a user has their access revoked from a package or an org., their granular access token also will have its access revoked from those packages or org.
57
+You can create up to 1000 granular access tokens on your npm account. You can set how long your token is valid for, at least one day in the future. Each token can access up to 50 organizations, and up to either 50 packages, 50 scopes, or a combination of 50 packages and scopes. Access tokens are tied to users’ permission; hence it cannot have more permission than the user at any point in time. If a user has their access revoked from a package or an org., their granular access token also will have its access revoked from those packages or org.
58
59
-When you give a token access to an organization, the token can only be used for managing organization settings and teams or users associated with the organization. It does not give the token the right to publish packages managed by the organization.
59
+When you give a token access to an organization, the token can only be used for managing organization settings and teams or users associated with the organization. It does not give the token the right to publish packages managed by the organization.
60
61
[create-token]: creating-and-viewing-access-tokens
62
[secure-token]: using-private-packages-in-a-ci-cd-workflow#securing-your-token
content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx
+10
-10
@@ -51,19 +51,19 @@ You can [create](#creating-access-tokens) and [view](#viewing-access-tokens) acc
51
<Screenshot src="/integrations/integrating-npm-with-external-services/create-token.png" alt="Screenshot of the create new token button" />
52
53
3. In the **Token name** field, enter a name for your token.
54
-
54
+
55
4. (Optional) In the **Description** field, enter a description for your token.
56
57
-5. In the **Expiration** field, enter a token expiration period. This must be between 1 and 365 days.
58
-
59
-6. (Optional) In the **Allowed IP Ranges** field, enter IP address ranges to restrict your access token to. You must use [CIDR][cidr-wiki] notation to enter IP address ranges. To add more than one allowed IP range, click **Add IP Range** and enter an IP range in the new text field.
57
+5. In the **Expiration** field, enter a token expiration period. The date must be at least 1 day in the future.
58
+
59
+6. (Optional) In the **Allowed IP Ranges** field, enter IP address ranges to restrict your access token to. You must use [CIDR][cidr-wiki] notation to enter IP address ranges. To add more than one allowed IP range, click **Add IP Range** and enter an IP range in the new text field.
60
61
<Screenshot src="/integrations/integrating-npm-with-external-services/granular-access-token-ip-range.png" alt="Screenshot of the allowed IP ranges section" />
62
-
63
-7. (Optional) In the **Packages and scopes** section, configure your token's access to packages and scopes.
62
+
63
+7. (Optional) In the **Packages and scopes** section, configure your token's access to packages and scopes.
64
65
- In the **Permissions** dropdown menu, select **No access**, **Read-only**, or **Read and write**.
66
- - Under **Select Packages**, select either:
66
+ - Under **Select Packages**, select either:
67
- **All Packages** to grant the token access to all packages the user account has access to.
68
- **Only select packages and scopes** to choose up to 50 specific packages or scopes to give the token access to. Then select specific packages or scopes from the dropdown menu.
69
@@ -71,14 +71,14 @@ You can [create](#creating-access-tokens) and [view](#viewing-access-tokens) acc
71
72
8. (Optional) In the **Organizations** section, configure your token's access to organizations.
73
- In the **Permissions** dropdown menu, select **No access**, **Read-only**, or **Read and write**.
74
- - Under **Select organizations**, select the organizations you want to grant your token access to.
74
+ - Under **Select organizations**, select the organizations you want to grant your token access to.
75
76
<Screenshot src="/integrations/integrating-npm-with-external-services/granular-access-token-organizations.png" alt="Screenshot of the organizations section" />
77
78
_**Note**: When you give a token access to an organization, the token can only be used for managing organization settings and teams or users associated with the organization. It does not give the token the right to publish packages managed by the organization._
79
80
9. Review the token summary, then click **Generate Token**.
81
-
81
+
82
<Screenshot src="/integrations/integrating-npm-with-external-services/granular-access-token-summary.png" alt="Screenshot of the granular access token summary and the generate token button" />
83
84
10. Copy the token from the top of page.
@@ -91,7 +91,7 @@ You can create tokens with **read-only** permissions or **read and publish** per
91
92
**Note:** You cannot create legacy automation tokens or granular access tokens from the CLI. You must use the website to generate these types of tokens. For more information, see "[Creating legacy tokens on the website](#creating-legacy-tokens-on-the-website)" and "[Creating granular access tokens on the website](#creating-granular-access-tokens-on-the-website)."
93
94
-</Note>
94
+</Note>
95
96
- **Read-only:** Tokens that allow installation and distribution only, but no publishing or other rights associated with your account.
97
- **Publish:** The default setting for new tokens, and most permissive token type. Publish tokens allow installation, distribution, modification, publishing, and all rights that you have on your account.