W3cubDocs

/npm

Requiring two-factor authentication in your organization

Skip to content
npm Docs
npmjs.comStatusSupport
About npm
Getting started
Packages and modules
Integrations
Organizations
Creating and managing organizations
Creating an organizationConverting your user account to an organizationRequiring two-factor authentication in your organizationRenaming an organizationDeleting an organization
Paying for your organization
Managing organization members
Managing teams
Managing organization packages
Policies
Threats and Mitigations
npm CLI
Table of contents

Organization owners can require organization members to enable two-factor authentication for their personal accounts, making it harder for malicious actors to access an organization's packages and settings

About two-factor authentication for organizations

Two-factor authentication (2FA) is an extra layer of security used when logging into websites or apps. You can require all members in your organization to enable two-factor authentication on npm. For more information about two-factor authentication, see "Configuring two-factor authentication.".

Note:

  • When you require use of two-factor authentication for your organization, members who do not use 2FA will be removed from the organization and lose access to its packages. You can add them back to the organization if they enable two-factor authentication.
  • An organization owner cannot opt-in to requiring 2FA for an organization if they do not have 2FA enabled on their account.
  • If you are the member of an organization that requires 2FA you will not be able to disable 2FA until you leave that organization.

Prerequisites

Before you can require organization members to use two-factor authentication, you must enable two-factor authentication for your account on npm. For more information, see "Configuring two-factor authentication.".

Before you require use of two-factor authentication, we recommend notifying organization members and asking them to set up 2FA for their accounts. You can see if members already use 2Fa in the organizations members page.

Requiring two-factor authentication in your organization

  1. Log in to npm with your user account.
    Screenshot of npm login dialog
  2. In the upper right corner of the page, click your profile picture, then click Account.
    Screenshot of account settings selection in user menu
  3. In the left sidebar, click the name of your organization.
    Screenshot of a selected organization
  4. On the organization settings page, click Members.
    Screenshot of the organization members tab

  5. Click the Enable 2FA Enforcement button.

    Screenshot of the enforce 2fa button

  6. If prompted, read the information about members who will be removed from the organization. Type your organization's name to confirm the change, then click Remove members & require two-factor authentication.

    Screenshot of the removal confirmation prompt

  7. If any members are removed from the organization, we recommend sending them an invitation that can reinstate their former privileges and access to your organization. They must enable two-factor authentication before they can accept your invitation.

Helping removed members and outside collaborators rejoin your organization

If any members are removed from the organization when you enable required use of two-factor authentication, they'll receive an email notifying them that they've been removed. They should then enable 2FA for their personal account, and contact an organization owner to request access to your organization.

Edit this page on GitHub

© npm, Inc. and Contributors
Licensed under the npm License.
npm is a trademark of npm, Inc.
https://docs.npmjs.com/requiring-two-factor-authentication-in-your-organization