npm Registry API (1.0.0)

Create a new npm access token with customizable permissions, scope restrictions, expiration, and CIDR IP range limitations.

Requirements:

• Must be authenticated
• Two-factor authentication is required for this endpoint
  • If 2FA is enabled on your account, provide the OTP via the npm-otp header
  • If 2FA is not enabled, an email OTP will be sent and must be provided via the npm-otp header
  • For WebAuthn users, the OTP is returned in the doneUrl after authentication

Important notices:

• All responses include security notices via the npm-notice header regarding token limitations

List all access tokens associated with the authenticated user's account.

Requirements:

• Must be authenticated with a valid Bearer token

Response includes:

• All responses include security notices via the npm-notice header
• Tokens are redacted for security: format is npm_aBcD...7890 (first 8 chars including prefix + ... + last 4 chars)
• Supports pagination via query parameters

Delete an npm access token. The token can be specified as:

• A UUID (token identifier)
• An npm-prefixed token (format: npm_ followed by 36 alphanumeric characters)

Requirements:

• Must be authenticated with a valid Bearer token
• May require 2FA OTP depending on user settings

Web authentication flow:

• When npm-auth-type=web and npm-command=token headers are present and 2FA is required, returns authentication URLs instead of an error

Exchange a valid OIDC id_token (provided as a Bearer token) for a short-lived npm registry access token for the specified package.

OIDC Token Requirements:

• The Bearer token must be an OIDC id_token from a supported Identity Provider (IdP)
• The aud (audience) claim must be set to npm:registry.npmjs.org

Important: The Bearer token must be an OIDC id_token from an Identity Provider (IdP) npm supports. This endpoint differs from the rest of the API, which expects a standard npm access token.

Retrieve all trusted publisher configurations for a package.

This endpoint allows users with write permission to the package to view all existing trusted publisher configurations that have been set up for OIDC token exchange for their package.

Configuration Structure

The structure of the payload follows a specific design. Each trusted provider has their own unique set of claims. In order to keep things clear and consistent, the properties to create a provider match the claims structure. The caveat is when a claim requires partial matching through parsing.

• All configurations MUST include a type and claims object
• Top-level "claims" MUST match the cloud provider's exact claim properties
• Claims MAY use exact string matching when supported
• Claims MAY use an object structure to define one or multiple partial matching rules
• Partial matching properties MUST be defined and documented by this API specification
• This documentation SHALL only provide matches for specifically defined claim items

Requirements

• Package MUST exist
• User MUST have write permission to the package
• MUST have 2FA enabled on their account
• User MUST be authenticated

Configure trusted publisher settings for a package to enable OIDC token exchange.

This endpoint allows users with write permission to the package to establish trust with CI/CD providers (GitHub Actions, GitLab CI, etc.) so that those services can publish to the package without requiring long-lived npm tokens.

Requirements

• Package MUST exist
• User MUST have write permission to the package
• MUST have 2FA enabled on their account
• User MUST be authenticated

Delete a specific trusted publisher configuration for a package by its UUID.

This endpoint allows users with write permission to the package to remove an existing trusted publisher configuration that was previously set up for OIDC token exchange.

Requirements

• Package MUST exist
• User MUST have write permission to the package
• MUST have 2FA enabled on their account
• User MUST be authenticated