@cryptotaxi247 / documentation
Code Commits Issues Pulls Sessions CI/CD
reggi/dev-engines
@reggi/path-to-regexp dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2 dependabot/npm_and_yarn/main/eslint-10.4.0 dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0 dependabot/npm_and_yarn/main/proc-log-7.0.0 dependabot/npm_and_yarn/npm_and_yarn-826852524d dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2 deprecate-totp-2fa dhei/classic-tokens gat-bypass-2fa-docs jpg619/fix-accessibility-content-flow jpg619/version-bump-tar-2 kartykp/gat-bypass-2fa-docs kartykp/upgrade-path-to-regex main maitxn/version-bump-tar patch-1 reggi/cache-based-on-version reggi/dev-engines reggi/fix-transform-prettier reggi/overrides update-search-sensitivity
mdx 84 lines 5.59 KB
Raw
1 ---
2 title: About two-factor authentication
3 redirect_from:
4 - /getting-started/using-two-factor-authentication
5 ---
6
7 [Two-factor authentication (2FA)][2fa] protects against unauthorized access to your account by confirming your identity using:
8
9 - Something you know (e.g., a password).
10 - Something you have (e.g., an ID badge or a cryptographic key).
11 - Something you are (e.g., a fingerprint or other biometric data).
12
13 When you enable 2FA, you will be prompted for a second form of authentication before performing certain actions on your account or packages to which you have write access. Depending on your 2FA configuration you will be either prompted to authenticate with a [security-key][webauthn] or a [time-based one-time password (TOTP)][totp].
14
15 - The security-key flow allows you to use biometric devices such as Apple [Touch ID][touch-id], [Face ID][face-id] or [Windows Hello][windows-hello] as well as physical keys such as [Yubikey][yubikey], [Thetis][thetis] or [Feitian][feitian] as your 2FA.
16 - To configure TOTP you will need to install an authenticator application that can generate OTPs such as [Authy][authy], [Google Authenticator][google-authenticator], or [Microsoft Authenticator][microsoft-authenticator] on your mobile device.
17
18 <Note>
19
20 **Note:** Two-factor authentication provides the best possible security for your account against attackers. We strongly recommend enabling 2FA on your account as soon as possible after you sign up.
21
22 </Note>
23
24 ## Two-factor authentication on npm
25
26 Two-factor authentication on npm can be enabled for authorization and writes, or authorization only.
27
28 ### Authorization and writes
29
30 By default, 2FA is enabled for authorization and writes. We will request a second form of authentication for certain authorized actions, as well as write actions.
31
32 | Action | CLI command |
33 | :------------------------------------------------ | :----------------------------------------------------- |
34 | Log in to npm | [`npm login`][login] |
35 | Change profile settings (including your password) | [`npm profile set`][profile-set] |
36 | Change 2FA modes for your user account | [`npm profile enable-2fa auth-and-writes`][2fa-enable] |
37 | Disable 2FA for your user account | [`npm profile disable-2fa`][2fa-disable] |
38 | Create tokens | [`npm token create`][token-create] |
39 | Revoke tokens | [`npm token revoke`][token-revoke] |
40 | Publish packages | [`npm publish`][publish] |
41 | Unpublish packages | [`npm unpublish`][unpublish] |
42 | Deprecate packages | [`npm deprecate`][deprecate] |
43 | Change package visibility | [`npm access public/restricted`][access] |
44 | Change user and team package access | [`npm access grant/revoke`][access] |
45 | [Change package 2FA requirements][pkg-2fa] | [`npm access 2fa-required/2fa-not-required`][access] |
46
47 ### Authorization only
48
49 If you enable 2FA for authorization only. We will request a second form of authentication only for certain authorized actions.
50
51 | Action | CLI command |
52 | :------------------------------------------------ | :----------------------------------------------- |
53 | Log in to npm | [`npm login`][login] |
54 | Change profile settings (including your password) | [`npm profile set`][profile-set] |
55 | Change 2FA modes for your user account | [`npm profile enable-2fa auth-only`][2fa-enable] |
56 | Disable 2FA for your user account | [`npm profile disable-2fa`][2fa-disable] |
57 | Create tokens | [`npm token create`][token-create] |
58 | Revoke tokens | [`npm token revoke`][token-revoke] |
59
60 [login]: https://docs.npmjs.com/cli/adduser
61 [profile-set]: https://docs.npmjs.com/cli/profile
62 [2fa-enable]: https://docs.npmjs.com/cli/profile
63 [2fa-disable]: https://docs.npmjs.com/cli/profile
64 [token-create]: https://docs.npmjs.com/cli/token
65 [token-revoke]: https://docs.npmjs.com/cli/token
66 [publish]: https://docs.npmjs.com/cli/publish
67 [unpublish]: https://docs.npmjs.com/cli/unpublish
68 [deprecate]: https://docs.npmjs.com/cli/deprecate
69 [access]: https://docs.npmjs.com/cli/access
70 [pkg-2fa]: /requiring-2fa-for-package-publishing-and-settings-modification
71 [authy]: https://authy.com/download/
72 [google-authenticator]: https://support.google.com/accounts/answer/1066447
73 [microsoft-authenticator]: https://www.microsoft.com/security/mobile-authenticator-app
74 [webauthn]: https://webauthn.guide/
75 [can-i-use]: https://caniuse.com/#search=webauthn
76 [u2f]: https://en.wikipedia.org/wiki/Universal_2nd_Factor
77 [windows-hello]: https://support.microsoft.com/en-us/windows/learn-about-windows-hello-and-set-it-up-dae28983-8242-bb2a-d3d1-87c9d265a5f0
78 [touch-id]: https://support.apple.com/en-gb/HT204587
79 [face-id]: https://support.apple.com/en-us/HT208108
80 [yubikey]: https://www.yubico.com/
81 [thetis]: https://thetis.io/
82 [feitian]: https://www.ftsafe.com/
83 [totp]: https://en.wikipedia.org/wiki/Time-based_one-time_password
84 [2fa]: https://en.wikipedia.org/wiki/Multi-factor_authentication