Prepare npm access

Publication requires a registry identity, permission for the package scope, and strong authentication.

Match the package scope to an owner

"name": "@your-scope/quiz-sdk"

your-scope must be your exact npm username or an npm organization where your account has publish permission. Similar-looking names are different. For example, person.name and personname are separate scopes.

Use an organization when several maintainers need controlled access or when you want package ownership separate from one personal account.

Log in and verify the active account

pnpm login
pnpm whoami

Complete browser authentication and two-factor prompts privately. Never paste passwords, one-time codes, recovery codes, or npm tokens into source files, issues, CI logs, or chat.

Enable two-factor authentication before publishing

npm requires either account two-factor authentication or a granular access token with bypass permission when creating or publishing packages. For an interactive release, enable account 2FA from npm account settings.

  1. Sign in on npmjs.com.
  2. Open your profile menu and select Account.
  3. Under Two-Factor Authentication, select Enable 2FA.
  4. Configure a supported security key.
  5. Store recovery codes in a password manager or another location separate from the second-factor device.

Do not solve local publishing with a long-lived automation token

Use interactive 2FA for manual releases. Use trusted publishing with short-lived OIDC credentials for CI when the package is established.

Check the package name and version

pnpm view @your-scope/quiz-sdk version

A 404 is expected for a new package if you have permission to the scope. If npm prints a version, the name exists. Never assume that a desired name is available.

Before later releases, query the exact current version and compare it with the local manifest. npm never permits overwriting an existing name and version pair.

Run npm's publication process without uploading

cd /absolute/path/to/packages/quiz-sdk
pnpm publish --dry-run

A successful dry run proves the package can build and pack. It does not prove that the active account owns the scope. Confirm organization membership separately.

Read authentication errors literally

ENEEDAUTH
No usable npm login or token is available for the registry.
E403 mentioning 2FA
The registry accepted your identity but requires stronger authentication for publishing.
E403 mentioning permission
The active account cannot publish under the requested scope or package.
E400 invalid package name
You may be in the wrong directory, or the manifest name violates npm naming rules. Print pwd and the current package identity first.

Official references

Check your understanding

  1. Your username is person.name, but the package is @personname/sdk. What must be true?

    Show answer

    An organization named personname must exist, and the active account must have permission to publish in it. The two strings are different npm scopes.

  2. Does a successful dry run prove registry permission?

    Show answer

    No. It proves local build and package preparation. The real registry permission check happens during publication or through account and organization settings.