dhei/classic-tokens
@reggi/path-to-regexp
dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2
dependabot/npm_and_yarn/main/eslint-10.4.0
dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0
dependabot/npm_and_yarn/main/proc-log-7.0.0
dependabot/npm_and_yarn/npm_and_yarn-826852524d
dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2
deprecate-totp-2fa
dhei/classic-tokens
gat-bypass-2fa-docs
jpg619/fix-accessibility-content-flow
jpg619/version-bump-tar-2
kartykp/gat-bypass-2fa-docs
kartykp/upgrade-path-to-regex
main
maitxn/version-bump-tar
patch-1
reggi/cache-based-on-version
reggi/dev-engines
reggi/fix-transform-prettier
reggi/overrides
update-search-sensitivity
| 1 | --- |
| 2 | title: Configuring two-factor authentication |
| 3 | --- |
| 4 | |
| 5 | import shared from '~/shared.js' |
| 6 | |
| 7 | You can enable two-factor authentication (2FA) on your npm user account to protect against unauthorized access to your account and packages using a [security-key][webauthn]. |
| 8 | |
| 9 | ## Prerequisites |
| 10 | |
| 11 | Before you enable 2FA on your npm user account, you must: |
| 12 | |
| 13 | - Update your npm client to version 5.5.1 or higher. |
| 14 | - To configure a security-key requires a modern browser that support [WebAuthn][can-i-use]. This will allow you to configure a biometric devices featuring Apple [Touch ID][touch-id], [Face ID][face-id], or [Windows Hello][windows-hello] as well as physical keys such as [Yubikey][yubikey], [Thetis][thetis], or [Feitian][feitian]. |
| 15 | |
| 16 | For more information on supported 2FA methods, see "[About two-factor authentication][about-two-factor-authentication]". |
| 17 | |
| 18 | ## Configuring 2FA from the website |
| 19 | |
| 20 | ### Enabling 2FA |
| 21 | |
| 22 | 1. <>{shared['user-login'].text}</> |
| 23 | |
| 24 | <>{shared['user-login'].image}</> |
| 25 | |
| 26 | 2. <>{shared['account-settings'].text}</> |
| 27 | |
| 28 | <>{shared['account-settings'].image}</> |
| 29 | |
| 30 | 3. On the account settings page, under "Two-Factor Authentication", click **Enable 2FA**. |
| 31 | |
| 32 | <Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-enable.png" alt="Screenshot showing Enable 2FA button" /> |
| 33 | |
| 34 | 4. When prompted provide your current account password and then click **Confirm password to continue**. |
| 35 | |
| 36 | 5. On the 2FA method page, select the method you would like to enable and click **Continue**. For more information on supported 2FA methods, see "[About two-factor authentication][about-two-factor-authentication]". |
| 37 | |
| 38 | <Screenshot src="/getting-started/setting-up-your-npm-user-account/device-selection.png" alt="Screenshot showing 2FA types" /> |
| 39 | |
| 40 | 6. Configure your security-key: |
| 41 | - Provide a name for your security-key and click **Add security key**. Follow the browser specific steps to add your security-key. |
| 42 | |
| 43 | <Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-add-security-key.png" alt="Screenshot showing security key setup" /> |
| 44 | |
| 45 | - Below is an example of configuration from Microsoft Edge running on a MacOS |
| 46 | |
| 47 | <Screenshot src="/getting-started/setting-up-your-npm-user-account/touch-id-mac-edge.png" alt="Screenshot showing 2FA device selection" /> |
| 48 | |
| 49 | 7. On the recovery code page, copy the recovery codes to your computer or other safe location that is not your second factor device. We recommend using a password manager. |
| 50 | |
| 51 | <Screenshot src="/getting-started/setting-up-your-npm-user-account/recovery-code.png" alt="Screenshot showing the Recovery Code page" /> |
| 52 | |
| 53 | _Recovery codes are the only way to ensure you can recover your account if you lose access to your second factor device. Each code can be used only once. You can [view and regenerate your recovery code][viewing-and-regenerating-recovery-code] from your 2FA settings page. For secondary account recovery options, see "[Configuring account recovery options][configuring-account-recovery-options]."_ |
| 54 | |
| 55 | 8. Click **Go back to settings** after confirming that you have saved your codes. |
| 56 | |
| 57 | ### Disabling 2FA for writes |
| 58 | |
| 59 | Check the [Authorization and writes][authorization-and-writes] section for more information on different operations that requires 2FA when this mode is enabled. |
| 60 | |
| 61 | <Note> |
| 62 | |
| 63 | **Note**: As a recommended setting, 2FA for write operations are _automatically enabled_ when setting up 2FA. The following steps explain how to disable it. |
| 64 | |
| 65 | </Note> |
| 66 | |
| 67 | 1. <>{shared['user-login'].text}</> |
| 68 | |
| 69 | <>{shared['user-login'].image}</> |
| 70 | |
| 71 | 2. <>{shared['account-settings'].text}</> |
| 72 | |
| 73 | <>{shared['account-settings'].image}</> |
| 74 | |
| 75 | 3. On the account settings page, under "Two-Factor Authentication", click **Modify 2FA**. |
| 76 | |
| 77 | <Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-modify.png" alt="Screenshot showing Modify 2FA button" /> |
| 78 | |
| 79 | 4. From the "Manage Two-Factor Authentication" navigate to "Additional Options" section |
| 80 | |
| 81 | 5. Clear the checkbox for "Require two-factor authentication for write actions" and click "Update Preferences" |
| 82 | |
| 83 | <Screenshot src="/getting-started/setting-up-your-npm-user-account/disable-2fa-button.png" alt="Screenshot showing a cleared check box to disable 2fa under Addition options" /> |
| 84 | |
| 85 | ### Disabling 2FA |
| 86 | |
| 87 | If you have 2FA enabled, you can remove it from your account settings page. |
| 88 | |
| 89 | <Note> |
| 90 | |
| 91 | **Note:** You cannot remove 2FA if you are a member of an organization that enforces 2FA. You can view the list of organizations memberships from your profile page under the "Organizations" tab. |
| 92 | |
| 93 | </Note> |
| 94 | |
| 95 | 1. <>{shared['user-login'].text}</> |
| 96 | |
| 97 | <>{shared['user-login'].image}</> |
| 98 | |
| 99 | 2. <>{shared['account-settings'].text}</> |
| 100 | |
| 101 | <>{shared['account-settings'].image}</> |
| 102 | |
| 103 | 3. On the account settings page, under "Two-Factor Authentication", click **Modify 2FA**. |
| 104 | |
| 105 | <Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-modify.png" alt="Screenshot showing Modify 2FA button" /> |
| 106 | |
| 107 | 4. Scroll to the bottom of the "Manage Two-Factor Authentication" page and click Disable 2FA. |
| 108 | |
| 109 | <Screenshot src="/getting-started/setting-up-your-npm-user-account/2fa-disable.png" alt="Screenshot showing Disable 2FA button" /> |
| 110 | |
| 111 | 5. Agree to the prompt from the browser. |
| 112 | |
| 113 | ## Configuring 2FA from the command line |
| 114 | |
| 115 | ### Enabling 2FA from the command line |
| 116 | |
| 117 | Security-key with WebAuthn can be used for authentication from both the web and the command line, but it can only be configured from the web. |
| 118 | |
| 119 | <Note> |
| 120 | |
| 121 | **Note:** Settings you configure on the command line will also apply to your profile settings on the npm website. |
| 122 | |
| 123 | </Note> |
| 124 | |
| 125 | For the best security experience, we recommend configuring 2FA through the web interface where you can set up security-key authentication. |
| 126 | |
| 127 | If you need to enable 2FA from the command line: |
| 128 | |
| 129 | 1. If you are logged out on the command line, log in using `npm login` command. |
| 130 | |
| 131 | 2. On the command line, type the [`npm profile`](/cli/profile) command along with the option for the 2FA mode you want to enable: |
| 132 | - To enable 2FA for authorization and writes, type: |
| 133 | |
| 134 | ``` |
| 135 | npm profile enable-2fa auth-and-writes |
| 136 | ``` |
| 137 | |
| 138 | - To enable 2FA for authorization only, type: |
| 139 | |
| 140 | ``` |
| 141 | npm profile enable-2fa auth-only |
| 142 | ``` |
| 143 | |
| 144 | ### Using 2FA with commands |
| 145 | |
| 146 | If you have enabled 2FA auth-and-writes, authentication will be handled automatically when using security-keys. For commands that require 2FA, you will be prompted to authenticate with your configured 2FA method. |
| 147 | |
| 148 | ### Removing 2FA from the command line |
| 149 | |
| 150 | 1. If you are logged out on the command line, log in using `npm login` command. |
| 151 | |
| 152 | 2. On the command line, type the following command: |
| 153 | |
| 154 | ``` |
| 155 | npm profile disable-2fa |
| 156 | ``` |
| 157 | |
| 158 | 3. When prompted, enter your npm password: |
| 159 | |
| 160 | <Prompt>npm password:</Prompt> |
| 161 | |
| 162 | 4. You will be prompted to authenticate with your configured 2FA method to complete the removal. |
| 163 | |
| 164 | ## Configuring account recovery options |
| 165 | |
| 166 | When you enable 2FA on your npm user account, we strongly recommend you link your GitHub and/or Twitter accounts to your npm user account. In the event you lose access to your 2FA device and recovery codes, these linked accounts can be used to verify your identity and expedite the recovery of your npm account. |
| 167 | |
| 168 | 1. <>{shared['user-login'].text}</> |
| 169 | |
| 170 | <>{shared['user-login'].image}</> |
| 171 | |
| 172 | 2. <>{shared['account-settings'].text}</> |
| 173 | |
| 174 | <>{shared['account-settings'].image}</> |
| 175 | |
| 176 | 3. To [link your GitHub][advanced-github-setup] account, on the account settings page, under "Linked Accounts & Recovery Option", click **Link with GitHub**. |
| 177 | |
| 178 | <Screenshot src="/getting-started/setting-up-your-npm-user-account/link-github-account.png" alt="Screenshot showing Link GitHub account button" /> |
| 179 | |
| 180 | 4. On the authorization page, verify all information looks correct. Then click **Authorize npm account link**. |
| 181 | 5. To [link your Twitter][advanced-twitter-setup] account, on the account settings page, under "Linked Accounts & Recovery Option", click **Link with Twitter**. |
| 182 | |
| 183 | <Screenshot src="/getting-started/setting-up-your-npm-user-account/link-twitter-account.png" alt="Screenshot showing Link Twitter account button" /> |
| 184 | |
| 185 | 6. On the authorization page, verify all information looks correct. Then click **Authorize app**. |
| 186 | |
| 187 | The Twitter or GitHub account is now linked to your npm account. To remove the link to either account, you can click the **Remove** button next to the account you want to remove from your npm account. |
| 188 | |
| 189 | [about-two-factor-authentication]: /about-two-factor-authentication |
| 190 | [authorization-and-writes]: /about-two-factor-authentication#authorization-and-writes |
| 191 | [login]: /cli/adduser |
| 192 | [recovering-your-2fa-enabled-account]: /recovering-your-2fa-enabled-account |
| 193 | [can-i-use]: https://caniuse.com/#search=webauthn |
| 194 | [viewing-and-regenerating-recovery-code]: /recovering-your-2fa-enabled-account#viewing-and-regenerating-recovery-code |
| 195 | [webauthn]: https://webauthn.guide/ |
| 196 | [u2f]: https://en.wikipedia.org/wiki/Universal_2nd_Factor |
| 197 | [windows-hello]: https://support.microsoft.com/en-us/windows/learn-about-windows-hello-and-set-it-up-dae28983-8242-bb2a-d3d1-87c9d265a5f0 |
| 198 | [touch-id]: https://support.apple.com/en-gb/HT204587 |
| 199 | [face-id]: https://support.apple.com/en-us/HT208108 |
| 200 | [yubikey]: https://www.yubico.com/ |
| 201 | [thetis]: https://thetis.io/ |
| 202 | [feitian]: https://www.ftsafe.com/ |
| 203 | [configuring-account-recovery-options]: /configuring-two-factor-authentication#configuring-account-recovery-options |
| 204 | [advanced-github-setup]: managing-your-profile-settings#linking-your-npm-and-github-accounts |
| 205 | [advanced-twitter-setup]: /managing-your-profile-settings#linking-your-npm-and-twitter-accounts |