@cryptotaxi247 / documentation
Code Commits Issues Pulls Sessions CI/CD
update-search-sensitivity
@reggi/path-to-regexp dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2 dependabot/npm_and_yarn/main/eslint-10.4.0 dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0 dependabot/npm_and_yarn/main/proc-log-7.0.0 dependabot/npm_and_yarn/npm_and_yarn-826852524d dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2 deprecate-totp-2fa dhei/classic-tokens gat-bypass-2fa-docs jpg619/fix-accessibility-content-flow jpg619/version-bump-tar-2 kartykp/gat-bypass-2fa-docs kartykp/upgrade-path-to-regex main maitxn/version-bump-tar patch-1 reggi/cache-based-on-version reggi/dev-engines reggi/fix-transform-prettier reggi/overrides update-search-sensitivity
mdx 46 lines 2.92 KB
Raw
1 ---
2 title: Requiring 2FA for package publishing and settings modification
3 ---
4
5 import shared from '~/shared.js'
6
7 All packages now require two-factor authentication (2FA) or a [granular access tokens with bypass 2FA enabled][creating-granular-access-token] for creating and publishing packages.
8
9 Modifying a package's settings also requires two-factor authentication (2FA).
10
11 For CI/CD workflows, consider using [trusted publishing](/trusted-publishers), which provides secure, token-free publishing that automatically enforces strong authentication without requiring manual token management.
12
13 <Note>
14
15 **Important notes about granular access tokens:**
16
17 - Bypass 2FA configuration is set at token creation
18 - When **bypass 2FA is disabled**: The system will check account-level and package-level settings to determine if 2FA is required
19 - When **bypass 2FA is enabled**: The token will bypass all 2FA requirements at all times, regardless of account-level or package-level 2FA settings
20 - When **Require two-factor authentication and disallow tokens** is selected at the package level, granular access tokens cannot be used regardless of their bypass 2FA setting
21
22 </Note>
23
24 ## Configuring two-factor authentication on package settings
25
26 1. <>{shared['user-login'].text}</>
27
28 <>{shared['user-login'].image}</>
29
30 2. Navigate to the package on which you want to require a second factor to publish or modify settings.
31
32 3. Click **Settings**.
33
34 <Screenshot src="/packages-and-modules/securing-your-code/2fa-package-admin.png" alt="Screenshot showing the admin tab on a package page" />
35
36 4. Under "Publishing access", select the requirements to publish a package.
37 1. **Require two-factor authentication or a granular access token with bypass 2fa enabled** (Default)
38 This is the default option for all new packages. With this option, maintainers must have two-factor authentication enabled for their account. If they publish a package interactively, using the `npm publish` command, they will be required to respond to a 2FA prompt when they perform the publish. However, maintainers may also create a [granular access token with bypass 2FA enabled][creating-granular-access-token] and use that for a non-interactive publish.
39 2. **Require two-factor authentication and disallow tokens** (Recommended) With this option, a maintainer must have two-factor authentication enabled for their account, and they must publish interactively. Maintainers will be required to respond to a 2FA prompt when they perform the publish. Granular access tokens cannot be used to publish packages, regardless of their bypass 2FA setting.
40
41 <Screenshot src="/packages-and-modules/securing-your-code/2fa-package-setting.png" alt="Screenshot showing the require two-factor option for a package" />
42
43 5 . Click **Update Package Settings**.
44
45 [config-2fa]: configuring-two-factor-authentication
46 [creating-granular-access-token]: creating-and-viewing-access-tokens#creating-granular-access-tokens-on-the-website