You can create and view access tokens from the website and command line interface (CLI).

Creating access tokens

Creating granular access tokens on the website

1. In the upper right corner of the page, click your profile picture, then click Access Tokens.

   

2. Click Generate New Token.

   

3. In the Token name field, enter a name for your token.

4. (Optional) In the Description field, enter a description for your token.

5. (Optional) Check the Bypass two-factor authentication checkbox if you want this token to bypass 2FA requirements for write actions.

   • This setting is unchecked (false) by default
   • By checking this box, the token will bypass 2FA for write actions even if 2FA is enabled at the account or package level

6. (Optional) In the Allowed IP Ranges field, enter IP address ranges to restrict your access token to. You must use CIDR notation to enter IP address ranges. To add more than one allowed IP range, click Add IP Range and enter an IP range in the new text field.

   

7. (Optional) In the Packages and scopes section, configure your token's access to packages and scopes.

   • In the Permissions dropdown menu, select No access, Read-only, or Read and write.
   • Under Select Packages, select either:
     • All Packages to grant the token access to all packages the user account has access to.
     • Only select packages and scopes to choose up to 50 specific packages or scopes to give the token access to. Then select specific packages or scopes from the dropdown menu.
   

8. (Optional) In the Organizations section, configure your token's access to organizations.

   • In the Permissions dropdown menu, select No access, Read-only, or Read and write.
   • Under Select organizations, select the organizations you want to grant your token access to.
   

   Note: When you give a token access to an organization, the token can only be used for managing organization settings and teams or users associated with the organization. It does not give the token the right to publish packages managed by the organization.

9. In the Expiration field, select a token expiration period from the dropdown menu. You can choose from predefined options or select Custom to specify a custom expiration date using the date picker.

   Note: The date must be at least 1 day in the future.

10. Review the token summary, then click Generate Token.

11. Copy the token from the top of page.

Creating tokens with the CLI

Viewing access tokens

Viewing tokens on the website

To view all tokens associated with your account, in the upper right corner of the page, click your profile picture, then click Access Tokens.

Viewing tokens on the CLI

To view all tokens associated with your account, on the command line, run the following command:

npm token list

Token attributes

• id: Use the token ID to refer to the token in commands.
• token: The first digits of the actual token.
• created: Date the token was created.
• CIDR whitelist: Restricts token use by IP address.