[docs]: bypass-2FA GATs blocked from account level operations starting august 2026 - #2006
Open
shmam wants to merge 10 commits into
Open
[docs]: bypass-2FA GATs blocked from account level operations starting august 2026#2006shmam wants to merge 10 commits into
shmam wants to merge 10 commits into
Conversation
Reflects the epic to remove account-identity capability from bypass-2FA Granular Access Tokens. Bypass 2FA still applies to publishing and other package write actions, but changes to email/password, 2FA configuration, recovery codes, token creation/escalation, and maintainer management now always require an interactive 2FA challenge. Refs github/npm#15355 Epic github/npm#15226 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 17ac1732-86bf-4b6f-a698-70850d2b7b27
shmam
changed the title
nishantms
reviewed
Jul 21, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Updates npm documentation to clarify that Granular Access Tokens (GATs) with Bypass 2FA enabled will be blocked from account-identity and governance operations starting August 2026, while still being usable for publishing (for now), and points readers to trusted publishing for CI/CD.
Changes:
- Refines “Bypass 2FA” behavior descriptions to scope bypassing primarily to publishing/package automation.
- Adds/propagates an August 2026 policy note that account-identity and governance actions require an interactive 2FA challenge.
- Normalizes a CLI doc table layout for
npm stage2FA/token behavior.
Show a summary per file
| File | Description |
|---|---|
| content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx | Narrows bypass-2FA behavior to publishing and adds an August 2026 restriction note with a cross-link. |
| content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx | Clarifies the bypass-2FA checkbox scope during token creation and links to the policy details. |
| content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx | Adds a new section describing which actions require interactive 2FA starting August 2026. |
| content/getting-started/setting-up-your-npm-user-account/about-two-factor-authentication.mdx | Adds a warning-note callout about bypass-2FA tokens not being usable for identity/governance actions starting August 2026. |
| content/cli/v12/commands/npm-stage.mdx | Re-formats tables describing 2FA requirements and token behavior for npm stage. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 4/4 changed files
- Comments generated: 4
- Review effort level: Low
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Starting early August 2026, Granular Access Tokens with Bypass 2FA enabled will no longer be permitted to perform account-identity or account-governance actions. Bypass-2FA tokens remain valid for publishing (for now)
Account-identity actions clarified across the docs:
Files updated
content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx— added an "Account-identity actions require an interactive 2FA challenge" section and refined the Bypass 2FA description.content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx— clarified the Bypass 2FA checkbox scope during token creation and linked to the new section.content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx— narrowed the "bypass 2FA is enabled" bullet to package write actions and added a bullet for account-identity actions.content/getting-started/setting-up-your-npm-user-account/about-two-factor-authentication.mdx— noted in the callout that account-identity actions cannot be performed with a bypass-2FA token.Notes