--- title: Two-Factor Authentication Across Package Registries description: A detailed survey of two-factor authentication policies across package registries, prompted by npm's removal of bypass-2FA tokens for account-governance... canonical: https://daily.dev/posts/two-factor-authentication-across-package-registries-zjr7wsnk7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Two-Factor Authentication Across Package Registries | daily.dev og:description: A detailed survey of two-factor authentication policies across package registries, prompted by npm's removal of bypass-2FA tokens for account-governance... og:url: https://daily.dev/posts/two-factor-authentication-across-package-registries-zjr7wsnk7 og:image: https://api.daily.dev/og/posts/zjr7WSnk7.png og:image:alt: Two-Factor Authentication Across Package Registries og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Two-Factor Authentication Across Package Registries **[Andrew Nesbitt](https://daily.dev/sources/nesbitt-io)** · 8 min read · 0 upvotes · 0 comments ## Summary A detailed survey of two-factor authentication policies across package registries, prompted by npm's removal of bypass-2FA tokens for account-governance actions this month as part of GitHub's September 2025 supply-chain security plan. Registries are grouped by identity model: those with native accounts (npm, PyPI, RubyGems, Packagist, Docker Hub, Hex.pm, Clojars, Hackage, CPAN), those delegating identity to a platform (crates.io via GitHub, pub.dev via Google, NuGet via Microsoft, Maven Central via GitHub/Google/native), git-based registries where a forge account substitutes for a publisher account (Homebrew, conda-forge, Spack, nixpkgs, Guix, Julia General, GitHub Actions), and email-gated or account-free registries (CRAN, CocoaPods, Go proxy, Swift Package Index). PyPI is the only registry with 2FA mandatory for all accounts since January 2024; NuGet required it on linked Microsoft accounts earlier, since March 2022. The piece also covers trusted publishing (OIDC-based short-lived tokens replacing long-lived API tokens for CI) and npm's new staged publishing feature, generally available since npm CLI 11.15.0, which inserts a human 2FA approval step between upload and public availability even when CI used OIDC. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### When did PyPI make two-factor authentication mandatory for all accounts? PyPI made two-factor authentication mandatory for every account starting January 1, 2024, accepting both TOTP and WebAuthn as methods. This followed a run-up phase that included distributing 4,000 hardware security keys to maintainers of top projects in 2022, making PyPI the only major registry with complete 2FA enforcement across its entire user base. _Track how registries like PyPI harden publishing against supply-chain attacks by following security updates on daily.dev._ ### What did npm change about 2FA bypass tokens this month? npm stopped accepting bypass-2FA tokens for account-governance actions, closing one of the remaining routes that let a reusable credential skip two-factor authentication. This is part of the plan GitHub set out in September 2025 to secure the npm supply chain; a further step proposed removing the bypass for local publishing too, though that has not yet shipped. _Stay ahead of npm publishing changes affecting CI tokens and maintainer workflows via daily.dev._ ### How does npm's staged publishing feature work with CI and 2FA? Staged publishing, generally available since npm CLI 11.15.0 in May 2026, splits publishing into two steps: any token uploads the tarball to a holding area without a 2FA prompt, then a maintainer must approve it through a separate 2FA challenge before it becomes installable. This approval step applies even when the upload used an OIDC trusted-publishing token, keeping a human check between CI and the public index. _Developers wiring CI to npm publishing can weigh trusted publishing versus staged approval flows discussed on daily.dev._ ## Similar posts on daily.dev - [Restricting npm bypass-2FA granular access tokens](https://daily.dev/posts/restricting-npm-bypass-2fa-granular-access-tokens-vh2dwd8rj) · GitHub Changelog · 0 upvotes · 0 comments - [npm install-time security and GAT bypass2fa deprecation](https://daily.dev/posts/npm-install-time-security-and-gat-bypass2fa-deprecation-hwjz1gmag) · GitHub Changelog · 0 upvotes · 0 comments - [The Hidden Costs of Package Registries](https://daily.dev/posts/the-hidden-costs-of-package-registries-xdkbztnuv) · OpenSSF · 0 upvotes · 0 comments - [No more tokens\! Locking down npm Publish Workflows—zachleat.com](https://daily.dev/posts/no-more-tokens-locking-down-npm-publish-workflows-zachleat-com-5csi2gg7j) · Zach Leatherman · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#authentication](https://daily.dev/tags/authentication), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/two-factor-authentication-across-package-registries-zjr7wsnk7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Two-Factor Authentication Across Package Registries","url":"https://daily.dev/posts/two-factor-authentication-across-package-registries-zjr7wsnk7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/two-factor-authentication-across-package-registries-zjr7wsnk7"},"datePublished":"2026-08-18T10:45:14.381Z","dateModified":"2026-08-18T10:45:38.276Z","description":"A detailed survey of two-factor authentication policies across package registries, prompted by npm's removal of bypass-2FA tokens for account-governance...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Andrew Nesbitt","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Andrew Nesbitt","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/nesbitt-io"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/two-factor-authentication-across-package-registries-zjr7wsnk7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,python,authentication,npm","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Andrew Nesbitt","item":"https://daily.dev/sources/nesbitt-io"},{"@type":"ListItem","position":3,"name":"Two-Factor Authentication Across Package Registries"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/two-factor-authentication-across-package-registries-zjr7wsnk7#faq","mainEntity":[{"@type":"Question","name":"When did PyPI make two-factor authentication mandatory for all accounts?","acceptedAnswer":{"@type":"Answer","text":"PyPI made two-factor authentication mandatory for every account starting January 1, 2024, accepting both TOTP and WebAuthn as methods. This followed a run-up phase that included distributing 4,000 hardware security keys to maintainers of top projects in 2022, making PyPI the only major registry with complete 2FA enforcement across its entire user base. Track how registries like PyPI harden publishing against supply-chain attacks by following security updates on daily.dev."}},{"@type":"Question","name":"What did npm change about 2FA bypass tokens this month?","acceptedAnswer":{"@type":"Answer","text":"npm stopped accepting bypass-2FA tokens for account-governance actions, closing one of the remaining routes that let a reusable credential skip two-factor authentication. This is part of the plan GitHub set out in September 2025 to secure the npm supply chain; a further step proposed removing the bypass for local publishing too, though that has not yet shipped. Stay ahead of npm publishing changes affecting CI tokens and maintainer workflows via daily.dev."}},{"@type":"Question","name":"How does npm's staged publishing feature work with CI and 2FA?","acceptedAnswer":{"@type":"Answer","text":"Staged publishing, generally available since npm CLI 11.15.0 in May 2026, splits publishing into two steps: any token uploads the tarball to a holding area without a 2FA prompt, then a maintainer must approve it through a separate 2FA challenge before it becomes installable. This approval step applies even when the upload used an OIDC trusted-publishing token, keeping a human check between CI and the public index. Developers wiring CI to npm publishing can weigh trusted publishing versus staged approval flows discussed on daily.dev."}}]} ```