Stage-only npm tokens for safer automation

You can now select Read and write (stage only) when creating an npm granular access token. This lets your automated workflows stage package versions for review without giving the token permission to publish new versions directly to the npm registry.

Your workflow uses npm stage publish to submit a version. A package maintainer then reviews and approves its release with two-factor authentication (2FA). npm rejects direct npm publish attempts with that token, even if you’ve configured it to bypass 2FA for automation.

Stage-only tokens retain other package write permissions, including moving dist-tags and deprecating versions. Protect them with the same care as any other write token.

Prepare your automation for the token transition

This release is opt-in and doesn’t change existing tokens or their direct-publish capabilities.

As previously announced, npm is targeting January 2027 to remove direct publishing through bypass-2FA tokens. If you can’t move to trusted publishing yet, stage-only tokens offer a migration path for token-based automation.

To get started:

1. Create a granular access token with Read and write (stage only) permissions for the packages your workflow needs.
2. Replace your workflow’s publishing token and use npm stage publish instead of npm publish.
3. Have a maintainer review and approve staged versions with 2FA.

Staged publishing works with existing npm packages. You’ll need publish access to the package, 2FA enabled on your npm account, npm CLI 11.15.0 or later, and Node.js 22.14.0 or later.

Learn more about staged publishing, and share questions or migration blockers in the npm community discussion category.

The post Stage-only npm tokens for safer automation appeared first on The GitHub Blog.