# Automatic npm publishing, with GitHub Actions & npm granular tokens

DevFeed: [Automatic npm publishing, with GitHub Actions & npm granular tokens](<https://devfeed.tech/articles/automatic-npm-publishing-with-github-actions-npm-granular-tokens-19042.md>)

Original publisher: [Read original article](<https://httptoolkit.com/blog/automatic-npm-publish-gha/>)

Author: HTTP Toolkit; Tim Perry

Published: 2023-03-22T10:00:00Z

Content type: tutorial

Language: en

Sources: [HTTP Toolkit](<https://devfeed.tech/sources/http-toolkit.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Security](<https://devfeed.tech/topics/security.md>), [ci](<https://devfeed.tech/topics/ci.md>)

Tags: [ci](<https://devfeed.tech/tags/ci.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [npm](<https://devfeed.tech/tags/npm.md>), [releases](<https://devfeed.tech/tags/releases.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This tutorial explains how to automate npm package publishing with GitHub Actions using npm granular access tokens. It describes restricting tokens to specific packages, storing them as GitHub Actions secrets, allowing publishing without 2FA for granular or automation tokens, and configuring a publishing workflow.

## Source excerpt

This week, at long last, GitHub announced granular access tokens for npm. This is a big deal! It's great for security generally, but also particularly useful if you maintain any npm packages, as it removes the main downside of automating npm publishing, by allowing you to give CI jobs only a very limited token instead of full 2FA-free access to your account. In the past, I've wished for this, because I maintain a fair few npm packages including some very widely used ones. The previous solution of "just disable 2FA on your account, create an all-powerful access token with global access to every package, and give that token to your CI job" was not a comfortable one. Regardless of your situation, isolating any risk of issues in security-sensitive situations like this is a good move, and ensures that any leak of (or legitimate access to) your CI secrets for one project doesn't imply a complete takeover of everything on your npm account. As soon as I saw this was now available, I jumped on automating npm publishing for a few of the packages that I've been manually publishing until now. The process is pretty quick and easy, let's walk through the steps: Get an access token for your package Log into npmjs.com Click your profile picture in the top right, then 'Access Tokens', 'Generate New Token', and 'Granular Access token' (or jump to npmjs.com/settings/$YOUR_USERNAME/tokens/granular-access-tokens/new) Set a useful name, a long expiry (up to you), 'Read and write' permissions, and pick the specific package that you're publishing Add your token as a secret for your project's GitHub Actions Jump to https://github.com/$YOU/$REPO/settings/secrets/actions/new Set NPM_PUBLISH_TOKEN as the secret name Copy the npm_... token from the previous step as the secret value In your npm package's settings (i.e. https://www.npmjs.com/package/$PACKAGE_NAME/access), allow publish without 2FA for granular/automation tokens only, so that tokens can be used for publishing: Add a publish step t