npm publish "EOTP ... one-time password" two-factor failure in CI

By Kaveh Alemi·Latchkey

The publishing account has two-factor authentication set to "Authorization and writes", so npm wants an interactive one-time password it cannot get in CI. The fix is an automation (or granular) token, which is exempt from the OTP prompt.

What this error means

npm publish stops with "npm ERR! code EOTP" and "This operation requires a one-time password from your authenticator." The job has no way to type the OTP, so it hangs or fails.

npm

npm ERR! code EOTP
npm ERR! This operation requires a one-time password from your authenticator.
npm ERR! You can provide a one-time password by passing --otp=<code> to the command you ran.

Common causes

2FA is set to require OTP on publish

The account 2FA level is "Authorization and writes", so every publish demands a one-time password. CI cannot supply an interactive code.

A classic auth token instead of an automation token

Standard tokens still require OTP under that 2FA level. Only automation (and granular) tokens skip the OTP requirement for publishing.

How to fix it

Use an automation token for CI

Create an "Automation" access token in npm settings and store it as the CI secret. Automation tokens are designed to bypass 2FA on publish.

.github/workflows/release.yml

- run: npm publish
  env:
    NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTOMATION_TOKEN }}

Or set 2FA to "Authorization only"

If you do not want automation tokens, lower the account 2FA requirement so writes do not demand an OTP. This is weaker; prefer automation tokens.

How to prevent it

Publish from CI with an automation or granular token, never a classic token under write-2FA.
Keep human accounts on strict 2FA and let CI use scoped automation tokens.
Rotate the automation token periodically and update the CI secret.

Frequently asked questions

What causes ""This operation requires a one-time password""?