Protect your npm account with 2FA and Authy
Tags: npm, node, security, authy
Published: 2017-10-10 08:54:38

---
title: Protect your npm account with 2FA and Authy
published: true
description: npm announced support for two factor authentication for accounts, here is how to set that up using the Authy app and protect your account and your packages.
tags: npm, node, security, authy
canonical_url: https://www.twilio.com/blog/2017/10/protect-your-npm-account-with-2fa-and-authy.html
cover_image: https://thepracticaldev.s3.amazonaws.com/i/4zkh4mka1348rdsizrad.png
---


> There has never been a major security incident caused by leaked npm credentials, but our security work is never finished.

This wasn't the headline that npm lead with when they <a href="http://blog.npmjs.org/post/166039777883/protect-your-npm-account-with-two-factor">announced their support for two factor authentication</a> recently, but it was a line that stuck out to me. It is fantastic to see that these critical parts of the infrastructure of web development are taking security seriously.

But that's only half the battle, it's up to all of us to secure our accounts with 2FA now too. Once you are setup with 2FA you will need both a password and a device to generate a one time code in order to authenticate with npm. This makes it much harder for anyone to take over your account and more importantly your npm packages.

Without further ado, here's how to secure your npm account with 2FA and <a href="https://authy.com">Authy</a>.

## Get up to date

To take advantage of this extra security, you'll need the latest npm installed, version 5.5.0. Head to the command line and run:

```bash
npm install -g npm@^5.5
```

Make sure you are logged in to your npm account too. Try running the new `profile` command to see.

```bash
npm profile get
```

If you're logged in, you will see your profile information. If not, you will get an error and you should run:

```bash
npm login
```

And fill in your details to authenticate your client. Once you are logged in you can then inspect your account with `npm profile get`.

<img alt="A view of my profile as displayed by the npm command line client. It shows that two factor authentication is currently disabled for my account." src="https://twilioinc.wpengine.com/wp-content/uploads/2017/10/NHsIpbbZXqaRAkT4AzSLzG3rqc6XwpxY3JHwJWLg40dI_e40hztZ026cDZhnr3eYmwLvdb5ddu7li4Kug8SPkj9V5TsT5UT9gxdXWqLTiLmT30BdkO0E2IHO9Qgjrynh-wyEPrY.png" class="aligncenter">

As you can see, at this stage I don't have two factor auth enabled. Let's fix that.

## The Authy app

<img src="https://twilioinc.wpengine.com/wp-content/uploads/2017/10/VSWQt3m_2wfZ0B8MtKtOT4I7iAAb0lDQ96zlml-gT3AeItbAPBaTeo4HbesFRmNlynk_aBG_ebtMCyAB_Lp0d3rw6_shvtLfyrzl8RTIkB0xAKqH-IjF4ZFy0ukglE0qAgJLw3I-169x300.png" alt="The authy app, showing a short lived two factor authentication code." width="169" height="300" class="alignright size-medium wp-image-21819" />

I'm going to set up my 2FA using the <a href="https://authy.com/">Authy app</a>. It has a bunch of features that set it apart from other authenticator apps, like multi device support, mobile and desktop apps and the ability to encrypt and backup your 2FA codes. If you don't already have the Authy app you can <a href="https://authy.com/download/">find all the downloads on the Authy site</a>.

## Enabling two factor authentication

We're logged in to our npm profile, we've got the Authy app ready. Let's enable 2FA.

Back on the command line you have two options for enabling two factor authentication. When enabled in `auth-only` mode you will always need a second factor to authenticate with npm. If you choose the `auth-and-writes` you will also need it when you update your account or publish a package. The second option is the most secure and is also the default, so we'll use that.

```bash
npm profile enable-tfa
```

If you just want to enable 2FA for authentication only, just run:

```bash
npm profile enable-tfa auth-only
```

You will be asked for your npm account password and when you enter it correctly you will be presented with a QR code.

<img alt="A QR code being displayed on the command line." src="https://twilioinc.wpengine.com/wp-content/uploads/2017/10/PX4xfDYk361F5C9hVXK51gR6fJPSFKzpXfDr79TwtUwpwh5IHo48grQudyQMZWTywiyFkellYMdp6L3Cj3FF6QFZeIBrwUaLEXCszLzlrExsoxi9UugYLhg6nqBweDARx8mQVJM.png" class="aligncenter">

Yes, a QR code on the command line, now I've seen them everywhere! Also, no you can't use that QR code to gain access to my account, I've already revoked it.

Grab your Authy app, add a new account and scan the barcode.

<img alt="A progression through screens in the Authy app; scanning the barcode, saving the account and then seeing the 6 digit one time password for the npm account." src="https://twilioinc.wpengine.com/wp-content/uploads/2017/10/2xZApZV3nxXxlx4H-Lj_kZWZaYH6_Ba6FRPawFi1O8G-Ul9BvIUe_Pl5Wv82ORifHJsqhdbKpsTOYWivGuKBjVnFwQZ_1oUEF_iOKHz6fXalKtBp5YRM7aWJk6nEDUQhQ5V1Ags.png" class="aligncenter">

Then enter the code to confirm you've setup your app correctly. If successfully you will see four backup codes printed to screen that you should save, in case you lose your authentication device. These are important, but less so with Authy as you can set the app to encrypt and backup your codes so that you can always reach them as long as you can sign into your Authy account.

## Your npm account and packages are secured

If you go through these steps successfully the next time you try to publish a package or update your profile you will be asked to enter your OTP code. Open the Authy app again, find the app and copy across the code and your action will complete successfully.

<img alt="Another command line view, this time of my setting something in my profile and entering the one time password to do so successfully. Then showing the profile view again, this time with two factor authentication turned on." src="https://twilioinc.wpengine.com/wp-content/uploads/2017/10/4H23JQJ1zJUpT9PwgXMIsLQYfvpFUXcSbC6wrCwYo-XWkqyLBjuz7f0dzI3JvGhRoHohDaUEU5sPlV75nBhyqTMIQ_B9K_fPdv7GSkPg2bwABkZVmiExtKEpSxCscymGXsgCGVY.png" class="aligncenter">

Here's me updating my profile and showing that two factor auth is enabled for auth-and-writes.

## Keep your profile and packages safe

I want to thank npm for making it possible to keep all those packages they look after safe. If you've just setup two factor authentication for your profile then I want to thank you too, for making the Node.js ecosystem a safer place.

If you're looking to implement two factor authentication for your own application, then do check out the <a href="https://www.twilio.com/docs/api/authy#authy-api">Twilio 2FA API</a>. You can create a normal 2FA flow with both SMS and token based codes as well as advanced features like <a href="https://www.twilio.com/docs/api/authy/authy-onetouch-api">OneTouch</a> that turns 2FA from copying codes to a simple <a href="https://www.twilio.com/two-factor-authentication/features/onetouch">approve or deny interaction</a>.

If you're excited to see npm adopt 2FA <a href="https://twitter.com/npmjs">give them a high five on Twitter</a>!

<img alt="A high five! Give yourself one for getting this far!" src="https://twilioinc.wpengine.com/wp-content/uploads/2017/10/dklKUMbUhJVGXAp6HAPuEdw2ufHoY3rQLzyhEyV_i_nzSB8C6RKyLhtGPCggCMZKC5ZXFu1vIIHcRciHRWSZLhijmg8o7fMZsyBc0fYiqpL_lFymO9Qfj_WpDjjN4WKBMd41E-M.png" class="aligncenter">

___

_[Protect your npm account with 2FA and Authy](https://www.twilio.com/blog/2017/10/protect-your-npm-account-with-2fa-and-authy.html) was originally posted on the [Twilio blog](https://www.twilio.com/blog/) on October 5, 2017_