How to fix npm ERR! code E401 npm ERR! 401 Unauthorized - This operation requires 2FA in npm

npmINTERMEDIATEHIGHUpdated Dec 5, 2025· 236 views

The E401 error indicates an authentication failure when attempting operations on npm's registry. When related to 2FA, it means your npm account has two-factor authentication enabled, but credentials are missing, invalid, or an OTP code is required.

Quick fix

Fixes npm ERR! code E401 npm ERR! 401 Unauthorized - This operation requires 2FA

npm login
  1. Check your npm account 2FA settings
  2. Log in interactively with OTP
  3. Generate an automation token for CI/CD
  4. Update .npmrc configuration
npm — error
npm login
npm ERR! code E401
npm ERR! 401 Unauthorized - This operation requires 2FA

What this error means

The E401 error indicates a general authentication failure when attempting operations on npm's registry (login, publish, etc.). When specifically related to 2FA, it means your npm account has two-factor authentication enabled, but either: - No authentication credentials were provided - The credentials are invalid/expired - A one-time password (OTP) code is missing or incorrect Unlike the EOTP error (which specifically requests an OTP), E401 is a broader authentication rejection that may require different solutions depending on context.

Typical symptoms

  • npm ERR! code E401 message appears when running npm login or npm publish
  • Authentication fails even with correct password in interactive mode
  • CI/CD pipelines fail with authentication errors during automated publish
  • Automation scripts hang or timeout waiting for OTP input
  • Error message references 'Bearer authorization' or 'Incorrect or missing password'
  • Previously working publish workflows suddenly require OTP/2FA

Common causes

  1. 2FA enabled on account without automation token
  2. Missing or expired access token in .npmrc
  3. Account set to 'auth-and-writes' mode requiring OTP on publish
  4. OTP expired before request completed
  5. Stale or corrupted npm cache with invalid credentials
  6. Registry URL mismatch between .npmrc and package-lock.json
  7. Token lacks 'Bypass 2FA' flag for CI/CD usage

How to fix "npm ERR! code E401 npm ERR! 401 Unauthorized - This operation requires 2FA"

1Check your npm account 2FA settings

Log in to https://npmjs.com, go to Account Settings > Two-Factor Authentication. Note whether 2FA is enabled for 'Authorization Only' or 'Authorization and Writes'. This determines whether you can publish without OTP entry.

2Log in interactively with OTP

For single operations, use npm login on your local machine:

bash
npm login

npm will prompt for username, password, and then an OTP code from your authenticator app. Have your authenticator ready before starting.

3Generate an automation token for CI/CD

For CI/CD workflows with 2FA enabled:

1. Visit https://npmjs.com/settings/tokens
2. Click 'Generate New Token'
3. Select 'Granular Access Token'
4. Set appropriate permissions (read, publish, or admin)
5. Enable 'Bypass 2FA' for write operations
6. Copy the token and store in your CI/CD provider's secrets manager

bash
export NPM_TOKEN=your_automation_token_here
4Update .npmrc configuration

Create or update your .npmrc file with your access token:

bash
# Store in ~/.npmrc (user home directory)
//registry.npmjs.org/:_authToken=your_npm_token_here

Never commit .npmrc with tokens to version control. Use environment variables in CI/CD:

bash
echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > ~/.npmrc
5Pass OTP code to npm commands

If you must use a password-based workflow with OTP:

bash
# Via environment variable
NPM_CONFIG_OTP=123456 npm publish

# Via command flag
npm publish --otp=123456

OTP codes expire within 30-60 seconds, so generate it immediately before running the command.

6Clear corrupted cache

If auth still fails after trying above steps, clear the npm cache:

bash
npm cache clean --force

Then attempt your operation again. This removes cached credentials that may be invalid.

Advanced notes

E401 vs EOTP Error Distinction: E401 is a general authentication rejection, while EOTP specifically means "this operation requires a one-time password." If you see EOTP, provide OTP via --otp flag. If you see E401, the issue is usually invalid/missing credentials or 2FA misconfiguration.

2FA Modes: npm offers two 2FA modes:
- Authorization Only: Requires OTP only when signing in
- Authorization and Writes: Requires OTP for both login AND publish/package modifications

Token Security (as of Nov 2025): npm deprecated long-lived classic tokens. New write-capable granular tokens default to 7-day expiration (max 90 days). For CI/CD, use trusted publishing (OIDC) or short-lived granular tokens with explicit 2FA bypass.

Frequently asked questions

What does "npm ERR! code E401 npm ERR! 401 Unauthorized - This operation requires" mean?
). When specifically related to 2FA, it means your npm account has two-factor authentication enabled, but either: - No authentication credentials were provided - The credentials are invalid/expired - A one-time password (OTP) code is missing or incorrect Unlike the EOTP error (which specifically requests an OTP), E401 is a broader authentication rejection that may require different solutions depending on context.
How do I fix "npm ERR! code E401 npm ERR! 401 Unauthorized - This operation requires"?
The E401 error indicates an authentication failure when attempting operations on npm's registry. When related to 2FA, it means your npm account has two-factor authentication enabled, but credentials are missing, invalid, or an OTP code is required.
What causes "npm ERR! code E401 npm ERR! 401 Unauthorized - This operation requires"?
2FA enabled on account without automation token Missing or expired access token in .npmrc Account set to 'auth-and-writes' mode requiring OTP on publish
Is the "npm ERR! code E401 npm ERR! 401 Unauthorized - This operation requires" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading