How do I publish a package to npm using an API key?

Question

NPM gives the ability to create access tokens with the right to publish packages to the NPM registry, assuming that you've set the package settings to "Require two-factor authentication or automation tokens" in "Publishing access" (and so implicitly it requires 2FA to be enabled, I assume).

How do I use this token to publish? I've checked the output of npm publish -- it asks for an OTP code, either as a prompt or a flag, and before I enabled 2FA it asked me for my password again. Using a fixed token would be easier than having to pull up my authenticator app. I could disable 2FA, but getting the token working is preferable.

score 2 · Answer 1 · edited Nov 01 '22 at 16:17

2

For verdaccio or similar you can use this:

> npm config set registry http://verdaccio/npm/

# then create and update local .npmrc file:
> npm config set _authToken=%YOUR_ACCES_TOKEN%

# and publish pointing to your registry
> npm publish --registry http://verdaccio/npm/

For proget:

[~]$ npm config set registry http://proget/npm/private-npm

[~]$ npm config set always-auth true
[~]$ npm config set _auth {ENCODEDAPIKEY}
[~]$ npm config set email {email address}

# then as usual
[~]$npm publish --registry {YOUR_REGISTRY}

Instructions are here proget and here verdaccio

edited Nov 01 '22 at 16:17

Zac

730
1
12
19

answered Apr 03 '21 at 23:26

697

321
4
16

2

Can these be done as environment variables rather than writing to the `.npmrc`? – CMCDragonkai May 20 '22 at 08:42
Yes, but it's more secure to use local config file – 697 Sep 08 '22 at 15:07
1

I'd argue it's more secure to use env variable. – CMCDragonkai Sep 08 '22 at 15:55
Sure, I'm not going to argue about that, someone else already did it =) – 697 Sep 09 '22 at 17:03
https://stackoverflow.com/questions/12461484/is-it-secure-to-store-passwords-as-environment-variables-rather-than-as-plain-t – 697 Sep 09 '22 at 17:04

score 2 · Accepted Answer · answered Jun 06 '22 at 07:43

2

The npm registry has 3 different kinds of token: Read-only, Automation, and Publish.

It sounds like you created a Publish token. You need to create an Automation token instead, since this is the only one that bypasses 2FA.

answered Jun 06 '22 at 07:43

Nathan

505
2
8

1

That was it. The other key bit of information is that you can't use the CLI to create these tokens: you have to use the GUI on the website. – Chris Midgley May 20 '23 at 19:14

How do I publish a package to npm using an API key?

2 Answers2