docs: Add token viewing and revocation details for GAT bypass 2FA
- Add description of bypass 2FA column in token list (shows checkmark for GATs with bypass enabled) - Add instructions for viewing full GAT details including bypass 2FA configuration - Add web interface method for token revocation (previously only documented CLI) - Clarify that all token types including GATs with bypass 2FA can be revoked
Karthikeyan Padaikathu committed
Oct 29, 2025 at 00:16 UTC
645bc9c4f344a34713646dd85342b348398b3a91
2 files changed
+20
-1
content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx
+7
@@ -133,6 +133,13 @@ To view all tokens associated with your account, in the upper right corner of th
133
134
<Screenshot src="/integrations/integrating-npm-with-external-services/tokens-profile.png" alt="Screenshot of the account menu with the tokens link selected" />
135
136
+The token list displays information about each token, including:
137
+- Token name and value (partially obscured)
138
+- Whether the token is configured to bypass two-factor authentication (shows a checkmark for granular access tokens with bypass enabled)
139
+- Creation date, last used date, and expiration date
140
+
141
+To view detailed information about a granular access token, including its full permissions, allowed IP ranges, and bypass 2FA configuration, click on the token name.
142
+
143
### Viewing tokens on the CLI
144
145
To view all tokens associated with your account, on the command line, run the following command:
content/integrations/integrating-npm-with-external-services/revoking-access-tokens.mdx
+13
-1
@@ -4,7 +4,19 @@ redirect_from:
4
- /revoking-authentication-tokens
5
---
6
7
-To keep your account and packages secure, we strongly recommend revoking (deleting) tokens you no longer need or that have been compromised. You can revoke any token you have created.
7
+To keep your account and packages secure, we strongly recommend revoking (deleting) tokens you no longer need or that have been compromised. You can revoke any token you have created, including legacy tokens and granular access tokens (with or without bypass 2FA enabled).
8
+
9
+## Revoking tokens on the website
10
+
11
+1. In the upper right corner of the page, click your profile picture, then click **Access Tokens**.
12
+
13
+2. Find the token you want to delete in the token list.
14
+
15
+3. Click the **×** button next to the token, or select multiple tokens and click **Delete Selected Tokens**.
16
+
17
+4. Confirm the deletion when prompted.
18
+
19
+## Revoking tokens from the command line
20
21
1. To see a list of your tokens, on the command line, run:
22