How to fix npm ERR! code EOTP npm ERR! This operation requires a one-time password in npm

npmINTERMEDIATEMEDIUMUpdated Dec 5, 2025· 197 views

npm requires a one-time password (OTP) from your 2FA authenticator to complete this operation. This error occurs when two-factor authentication is enabled on your npm account and you attempt write operations like npm publish without providing the OTP code.

Quick fix

Fixes npm ERR! code EOTP npm ERR! This operation requires a one-time password

npm publish --otp=123456
  1. Provide OTP via --otp flag
  2. Use environment variable for repeated commands
  3. For CI/CD: Create automation token with 2FA bypass
  4. Alternative: Disable 2FA for write operations
npm — error
npm publish --otp=123456
npm ERR! code EOTP
npm ERR! This operation requires a one-time password

What this error means

This error occurs when two-factor authentication (2FA) is enabled on your npm account and you attempt write operations (like npm publish) without providing the OTP code. The operation cannot proceed until you supply the time-sensitive code from your authenticator app. EOTP stands for "Error One-Time Password". npm 2FA has two levels: 1. **Authorization only** - OTP required for login/account changes but not publishing 2. **Authorization and writes** - OTP required for all sensitive operations including publish The OTP code typically expires within 30 seconds, so you need to provide it quickly.

Typical symptoms

  • npm publish command fails with 'npm ERR! code EOTP' message
  • npm profile set and other security-sensitive commands fail with EOTP error
  • CI/CD pipeline fails when attempting to publish packages
  • Error message: 'This operation requires a one-time password from your authenticator'
  • Operations timeout if OTP expires before command completes

Common causes

  1. 2FA is enabled on your npm account with 'auth-and-writes' setting
  2. Running npm publish without supplying the --otp flag
  3. CI/CD automation attempting to publish without automation token
  4. OTP was provided but expired before command completed
  5. OTP was typed incorrectly
  6. Using a legacy access token instead of automation token

How to fix "npm ERR! code EOTP npm ERR! This operation requires a one-time password"

1Provide OTP via --otp flag

For immediate interactive use, append the --otp flag with your 6-digit code:

bash
npm publish --otp=123456

Replace 123456 with the current code from Google Authenticator, Authy, or your 2FA app. OTP codes expire in ~30 seconds, so complete the command quickly.

2Use environment variable for repeated commands

Set the OTP via environment variable to avoid typing it each time:

bash
export NPM_CONFIG_OTP=123456
npm publish

For Windows PowerShell:

powershell
$env:NPM_CONFIG_OTP='123456'
npm publish
3For CI/CD: Create automation token with 2FA bypass

This is the recommended solution for automated publishing:

1. Log into https://www.npmjs.com/settings/~/tokens
2. Click 'Generate New Token'
3. Select 'Granular Access Token'
4. Grant 'write' or 'publish' permissions
5. Enable 'Bypass 2FA' checkbox
6. Store token as a secret in your CI/CD platform

Create .npmrc in your project:

bash
//registry.npmjs.org/:_authToken=${NPM_TOKEN}

Now npm publish will work without OTP prompts.

4Alternative: Disable 2FA for write operations

If you want to publish manually without OTP but keep 2FA for account security:

1. Go to https://www.npmjs.com/settings/~/security
2. Click 'Modify 2FA'
3. Navigate to 'Additional Options'
4. Uncheck 'Require two-factor authentication for write actions'
5. Click 'Update Preferences'

Note: This is less secure; prefer automation tokens instead.

Advanced notes

Automation vs Granular Tokens: Automation tokens are being deprecated in favor of granular tokens with explicit "Bypass 2FA" capability. When creating new tokens, use granular tokens.

Trusted Publishing: For GitHub Actions or GitLab CI, use OIDC trusted publishing instead of long-lived tokens. This eliminates token rotation requirements and is the most secure approach.

Token Expiration: New write-capable granular tokens default to 7-day expiration (max 90 days). For CI/CD, use either trusted publishing or short-lived granular tokens with explicit 2FA bypass.

System Clock: OTP is time-sensitive. Ensure your system clock is synchronized (OTP is TOTP - Time-based One-Time Password).

Frequently asked questions

What does "npm ERR! code EOTP npm ERR! This operation requires a one-time passwor" mean?
This error occurs when two-factor authentication (2FA) is enabled on your npm account and you attempt write operations (like npm publish) without providing the OTP code. The operation cannot proceed until you supply the time-sensitive code from your authenticator app. EOTP stands for "Error One-Time Password".
How do I fix "npm ERR! code EOTP npm ERR! This operation requires a one-time passwor"?
npm requires a one-time password (OTP) from your 2FA authenticator to complete this operation. This error occurs when two-factor authentication is enabled on your npm account and you attempt write operations like npm publish without providing the OTP code.
What causes "npm ERR! code EOTP npm ERR! This operation requires a one-time passwor"?
2FA is enabled on your npm account with 'auth-and-writes' setting Running npm publish without supplying the --otp flag CI/CD automation attempting to publish without automation token
Is the "npm ERR! code EOTP npm ERR! This operation requires a one-time passwor" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading