NPM-TOKEN(1)

🎀 NAME 🎀

npm-token — manage your authentication tokens, bestie. Like, your whole token situation? Handled 💅

✨ Synopsis ✨

npm token list
npm token revoke <id|token>
npm token create

Heads up, babe: this command is unaware of workspaces. Like, it literally does not know they exist 🙈

---

🦋 DESCRIPTION 🦋

Okay so this is the command that lets you list, create and revoke authentication tokens. That's the whole vibe. Three things. Iconic, honestly 👑

🌸 Listing tokens 🌸

When you list tokens, you get an abbreviated token shown to you. For security purposes the full token is not displayed. So don't come for her asking for the whole thing — that's the point, bestie 🔒✨

🎀 Generating tokens 🎀

When you generate tokens, you will be prompted for your password and, if you have two-factor authentication enabled, an otp. So have both ready, bestie 🫶

Please refer to the docs website for more info on generating tokens for CI/CD:

https://docs.npmjs.com/creating-and-viewing-access-tokens

🧚 Revoking tokens 🧚

When you're revoking a token, you can use the full token — like, the thing you get back from npm token create, or the one you can find chillin' in an .npmrc file — or you can use a truncated id.

If the truncated id you give isn't distinct enough to tell multiple existing tokens apart, you'll need to use enough of the id so that npm can actually distinguish between them. Full token ids can be found on the npm website:

https://www.npmjs.com

…or in the --parseable or --json output of npm token list.

⚠️ Real talk: this command will NOT accept the truncated token found in the normal npm token list output. Nope. Not that one. Use the id from --parseable / --json or the website, mwah 💋

A revoked token will immediately be removed from the registry and you will no longer be able to use it. Gone. Poof. Periodt 💀

---

👑 CONFIGURATION 👑

🌈 name

• Default: null
• Type: null or String

When creating a Granular Access Token with npm token create, this sets the name/description for the token 🏷️

🌈 token-description

• Default: null
• Type: null or String

Description text for the token when using npm token create 💌

🌈 expires

• Default: null
• Type: null or Number

When creating a Granular Access Token with npm token create, this sets the expiration in days. If you don't specify it, the server will determine the default expiration. The server is the main character here, apparently 👑⏳

🌈 packages

• Default:
• Type: null or String (can be set multiple times)

When creating a Granular Access Token with npm token create, this limits the token access to specific packages 📦✨

🌈 packages-all

• Default: false
• Type: Boolean

When creating a Granular Access Token with npm token create, this grants the token access to all packages instead of limiting it to specific packages. All of them. The whole shelf 🗄️💅

🌈 scopes

• Default: null
• Type: null or String (can be set multiple times)

When creating a Granular Access Token with npm token create, this limits the token access to specific scopes. Provide a scope name (with or without the @ prefix — either slaps) 🎯

🌈 orgs

• Default: null
• Type: null or String (can be set multiple times)

When creating a Granular Access Token with npm token create, this limits the token access to specific organizations 🏢🌸

🌈 packages-and-scopes-permission

• Default: null
• Type: null, "read-only", "read-write", "read-write-stage-only", or "no-access"

When creating a Granular Access Token with npm token create, this sets the permission level for packages and scopes. The options are "read-only", "read-write", "read-write-stage-only", or "no-access".

Lowkey important: "read-write-stage-only" grants publish access that stages releases instead of publishing them directly 👀🔥

🌈 orgs-permission

• Default: null
• Type: null, "read-only", "read-write", or "no-access"

When creating a Granular Access Token with npm token create, this sets the permission level for organizations. The options are "read-only", "read-write", or "no-access" 🏛️

🌈 cidr

• Default: null
• Type: null or String (can be set multiple times)

This is a list of CIDR address to be used when configuring limited access tokens with the npm token create command 🌐

🌈 bypass-2fa

• Default: false
• Type: Boolean

When creating a Granular Access Token with npm token create, setting this to true will allow the token to bypass two-factor authentication. This is useful for automation and CI/CD workflows 🤖⚡

🌈 password

• Default: null
• Type: null or String

Password for authentication. Can be provided via command line when creating tokens, though it's generally safer to be prompted for it. Yeah bestie, let the prompt do its thing — don't be out here typing secrets into your shell history 🙈🔐

🌈 registry

• Default: "https://registry.npmjs.org/"
• Type: URL

The base URL of the npm registry 🛰️

🌈 otp

• Default: null
• Type: null or String

This is a one-time password from a two-factor authenticator. It's needed when publishing or changing package permissions with npm access.

If it's not set, and a registry response fails with a challenge for a one-time password, npm will prompt on the command line for one 🎲✨

🌈 read-only

• Default: false
• Type: Boolean

This is used to mark a token as unable to publish when configuring limited access tokens with the npm token create command 🚫📤

---

💖 SEE ALSO 💖

• npm help login
• npm help registry
• npm help config
• npm help npmrc
• npm help owner
• npm help whoami
• npm help profile

---

Okay that's the whole page, bestie. This one's brought to you by NPM@12.2.1, dated October 2026 — screenshot it, memorise it, slay it 💅🎀🦋💜