The npm setting called "Require two-factor authentication and disallow tokens" means a package can be published only by a maintainer with 2FA who answers a prompt, and granular access tokens cannot publish at all. Per npm's trusted publishing page, it does not affect publishing through OIDC.
The two options
In a package's Settings, under Publishing access, npm offers two choices.
| Option | Who can publish |
|---|---|
| Require two-factor authentication or a granular access token with bypass 2fa enabled (the default) | Maintainers with 2FA at an interactive prompt, or a granular token with bypass 2FA turned on for non interactive publishes |
| Require two-factor authentication and disallow tokens (marked Recommended) | Maintainers with 2FA who publish interactively. Granular tokens cannot publish, whatever their bypass setting |
The first option is the default. The second is marked recommended.
How to change it
- Sign in to npm.
- Open the package and click Settings.
- Under Publishing access, choose the second option.
- Click Update Package Settings.
Do this for every package you maintain. Scopes with many packages mean many visits, so list your packages first and tick them off.
What breaks
Anything that publishes with a token will start failing. That includes old CI jobs and release scripts. Before flipping the switch:
- Find workflows that call npm publish with a token secret.
- Move them to trusted publishing, which the npm docs recommend, using npm CLI 11.5.1 or later and Node 22.14.0 or later on a supported cloud hosted CI provider.
- Test one release.
- Then set the package to disallow tokens, and delete the old token.
Note two documented quirks of trusted publishing: npm does not validate the configuration when you save it, so a typo shows up only at publish time, and a new configuration must complete a first publish within 2 days or it expires.
Why it is worth doing
Tokens leak. They end up in CI logs, dotfiles and laptops. A package that disallows tokens cannot be published with a stolen one, so an attacker needs a maintainer's interactive session and second factor, or your trusted workflow. That moves your focus to protecting those two things: see maintainer 2FA methods ranked and the release workflow permissions guide.
When to hold off
- Your CI provider is not supported for trusted publishing and you cannot publish by hand.
- A bot account must publish many packages and you have no replacement yet.
In those cases keep tokens, make them granular with short lifetimes, and plan a migration. The GitHub plan for npm lists a seven day limit on granular publishing tokens and disallowing tokens by default as intended changes, with no dates, so confirm current behavior on npm's site.
A rollout list
- Inventory packages and owners. See who can publish your package.
- Move CI to trusted publishing.
- Set disallow tokens.
- Revoke old tokens.
- Do a test release.
Safeguard scans your dependencies and generates SBOMs; try the free scan at gold.safeguard.sh/scan.
Quick check
Does this block my trusted publishing workflow?
No. The trusted publishing page says the setting does not affect OIDC publishing.
Can a bypass 2FA token still publish under this setting?
No. The docs say granular tokens cannot publish regardless of their bypass setting.
Sources
- npm Docs: Requiring 2FA for package publishing
- npm Docs: Trusted publishing
- GitHub Blog: Our plan for a more secure npm supply chain
Last reviewed: 19 October 2026.
