NPM-ACCESS(1)

👑 NAME

npm-access — the one that sets the access level on your published packages, bestie. Think of it as the bouncer for your npm packages: who gets in, who gets read-only, who gets to touch things. 💅

---

✨ SYNOPSIS

npm access list packages [<user>|<scope>|<scope:team>] [<package>]
npm access list collaborators [<package> [<user>]]
npm access get status [<package>]
npm access set status=public|private [<package>]
npm access set mfa=none|publish|automation [<package>]
npm access grant <read-only|read-write> <scope:team> [<package>]
npm access revoke <scope:team> [<package>]

Heads up bestie: this command is unaware of workspaces. Like, it literally does not know they exist. 😭

---

🎀 DESCRIPTION

So this is the whole vibe: you use it to set access controls on private packages. That's the main character job. 🔥

For all of the subcommands, npm access will perform actions on the packages in the current working directory if no package name is passed to the subcommand. So if you're lazy (same) and just run it bare, it'll act on whatever's right there in front of you.

• grant / revoke — add or remove the ability of users and teams to have read-only or read-write access to a package. Basically giving out or taking back the keys to your house. 🔑✨

---

💖 DETAILS

Okay so here's the tea, npm access always operates directly on the current registry, and you can configure that from the command line using --registry=<registry url>. Slay. 🌈

Unscoped packages are always public. No exceptions, no negotiation, that's just how it is. 💀

Scoped packages default to restricted, but you've got two glow-up options:

• Publish them as public using npm publish --access=public
• Or set their access as public using npm access set status=public after the initial publish

Now, you can't just waltz in and change access on anything — you must have privileges to set the access of a package. The vibe check is:

• You are an owner of an unscoped or scoped package. 👑
• You are a member of the team that owns a scope.
• You have been given read-write privileges for a package, either as a member of a team or directly as an owner.

If you have two-factor authentication enabled then you'll be prompted to provide a second factor, or you may use the --otp=... option to specify it on the command line. (Not me forgetting my OTP every single time 🙈)

If your account is not paid, then attempts to publish scoped packages will fail with an HTTP 402 status code (logically enough), unless you use --access=public. Paywall moment. 💸

Management of teams and team memberships is done with the npm team command — that's a whole different manpage, go look. 🫶

---

🦋 CONFIGURATION

json

• Default: false
• Type: Boolean

Whether or not to output JSON data, rather than the normal output.

• In npm pkg set it enables parsing set values with JSON.parse() before saving them to your package.json.

Not supported by all npm commands. So don't come for me if it doesn't work everywhere. 😌

otp

• Default: null
• Type: null or String

This is a one-time password from a two-factor authenticator. It's needed when publishing or changing package permissions with npm access.

If not set, and a registry response fails with a challenge for a one-time password, npm will prompt on the command line for one. So it's got you either way. ✨

registry

• Default: "https://registry.npmjs.org/"
• Type: URL

The base URL of the npm registry. That's the one, that's the address. 🏠

---

🌸 SEE ALSO

• libnpmaccess ⟨https://npm.im/libnpmaccess⟩
• npm help team
• npm help publish
• npm help config
• npm help registry

---

And that's the whole page, bestie — no notes, you ate that. 💅✨

Signed, sealed, delivered by NPM@12.2.1, dated October 2026. Go forth and grant access responsibly. 🎀🦋