[docs]: bypass-2FA GATs blocked from account level operations starting august 2026

content/cli/v12/commands/npm-stage.mdx

@@ -77,14 +77,14 @@ Before using `npm stage` commands, ensure the following requirements are met:
 
 ### 2FA Requirements by Subcommand
 
-| Command              | Requires 2FA | Notes                                                    |
-| -------------------- | ------------ | -------------------------------------------------------- |
-| `npm stage publish`  | No           | Designed for automated workflows; defers 2FA to approval |
-| `npm stage list`     | No           | View staged packages                                     |
-| `npm stage view`     | No           | View staged package details                              |
-| `npm stage approve`  | Yes          | Prompts for 2FA to publish the staged package            |
-| `npm stage reject`   | Yes          | Prompts for 2FA to permanently remove the staged package |
-| `npm stage download` | No           | Downloads the tarball for local inspection               |
+| Command | Requires 2FA | Notes |
+| --- | --- | --- |
+| `npm stage publish` | No | Designed for automated workflows; defers 2FA to approval |
+| `npm stage list` | No | View staged packages |
+| `npm stage view` | No | View staged package details |
+| `npm stage approve` | Yes | Prompts for 2FA to publish the staged package |
+| `npm stage reject` | Yes | Prompts for 2FA to permanently remove the staged package |
+| `npm stage download` | No | Downloads the tarball for local inspection |
 
 ### Tag Behavior
 
@@ -96,12 +96,12 @@ The tag is an immutable property of the staged package. Once a package is staged
 
 The key difference with staged publishing is that `npm stage publish` never requires a 2FA prompt, regardless of token type. This is what makes it suitable for automated workflows. The goal of `npm stage publish` is deferring proof-of-presence to a later point in time.
 
-| Token Type         | `npm stage publish`    | `npm publish`                                         |
-| ------------------ | ---------------------- | ----------------------------------------------------- |
-| GAT with bypass    | Can stage              | Can publish (if allowed by package publishing access) |
-| GAT without bypass | Can stage              | 2FA prompt (if allowed by package publishing access)  |
-| Session token      | Can stage              | 2FA prompt                                            |
-| Trust token (OIDC) | Can stage (if allowed) | Can publish (if allowed)                              |
+| Token Type | `npm stage publish` | `npm publish` |
+| --- | --- | --- |
+| GAT with bypass | Can stage | Can publish (if allowed by package publishing access) |
+| GAT without bypass | Can stage | 2FA prompt (if allowed by package publishing access) |
+| Session token | Can stage | 2FA prompt |
+| Trust token (OIDC) | Can stage (if allowed) | Can publish (if allowed) |
 
 ### Trust Relationship Permissions
 

content/getting-started/setting-up-your-npm-user-account/about-two-factor-authentication.mdx

@@ -27,6 +27,8 @@ When you enable 2FA, you will be prompted for a second form of authentication be
 - Two-factor authentication (2FA) enabled on your account, OR
 - A granular access token with bypass 2FA enabled
 
+Starting August 2026, Account-identity and organization-governance actions cannot be performed with a bypass-2FA token.
+
 For more information, see the npm documentation on [requiring 2FA for package publishing](/requiring-2fa-for-package-publishing-and-settings-modification).
 
 </Note>

content/integrations/integrating-npm-with-external-services/about-access-tokens.mdx

@@ -42,7 +42,19 @@ You can create up to 1000 granular access tokens on your npm account. You can se
 
 When you give a token access to an organization, the token can only be used for managing organization settings and teams or users associated with the organization. It does not give the token the right to publish packages managed by the organization.
 
-The Bypass 2FA capability applies to tokens with write access and is set to false by default at token creation. When the Bypass 2FA option is set to true, this setting takes precedence over account-level and package-level 2FA settings. This means that even if account-level 2FA is enabled and/or package-level 2FA is required, 2FA will still be bypassed when using the token. Do not set Bypass 2FA to true if a package or organization requires fully enforced 2FA.
+The Bypass 2FA capability applies to tokens with write access and is set to false by default at token creation. When the Bypass 2FA option is set to true, this setting takes precedence over account-level and package-level 2FA settings for package and automation actions such as publishing. This means that even if account-level 2FA is enabled and/or package-level 2FA is required, 2FA will still be bypassed when using the token to publish. Do not set Bypass 2FA to true if a package or organization requires fully enforced 2FA.
+
+### Account-identity actions require an interactive 2FA challenge
+
+Starting August 2026, tokens with **Bypass 2FA** enabled can no longer be used to perform account-identity or account-governance actions. These actions always require using a token with an interactive 2FA challenge:
+
+- Change email or password
+- Modify or disable 2FA configuration
+- Create, escalate, or manage access tokens
+- Add or remove package maintainers
+- Organization and team governance actions
+
+At the moment, bypass-2FA tokens can still be used for direct publishing. For CI/CD publishing, consider adopting [trusted publishing](/trusted-publishers) instead.
 
 [create-token]: creating-and-viewing-access-tokens
 [secure-token]: using-private-packages-in-a-ci-cd-workflow#securing-your-token

content/integrations/integrating-npm-with-external-services/creating-and-viewing-access-tokens.mdx

@@ -22,9 +22,10 @@ You can [create](#creating-access-tokens) and [view](#viewing-access-tokens) acc
 
 4. (Optional) In the **Description** field, enter a description for your token.
 
-5. (Optional) Check the **Bypass two-factor authentication** checkbox if you want this token to bypass 2FA requirements for write actions.
+5. (Optional) Check the **Bypass two-factor authentication** checkbox if you want this token to bypass 2FA requirements for package publishing.
    - This setting is unchecked (false) by default
-   - By checking this box, the token will bypass 2FA for write actions even if 2FA is enabled at the account or package level
+   - By checking this box, the token will bypass 2FA for publishing even if 2FA is enabled at the account or package level
+   - Starting August 2026, bypass 2FA does **not** apply to account-identity or organization-governance actions. Those actions always require an interactive 2FA challenge. For more information, see "[About access tokens](about-access-tokens#account-identity-actions-require-an-interactive-2fa-challenge)."
 
 6. (Optional) In the **Allowed IP Ranges** field, enter IP address ranges to restrict your access token to. You must use [CIDR][cidr-wiki] notation to enter IP address ranges. To add more than one allowed IP range, click **Add IP Range** and enter an IP range in the new text field.
 

content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx

@@ -16,7 +16,8 @@ For CI/CD workflows, consider using [trusted publishing](/trusted-publishers), w
 
 - Bypass 2FA configuration is set at token creation
 - When **bypass 2FA is disabled**: The system will check account-level and package-level settings to determine if 2FA is required
-- When **bypass 2FA is enabled**: The token will bypass all 2FA requirements at all times, regardless of account-level or package-level 2FA settings
+- When **bypass 2FA is enabled**: The token will bypass 2FA requirements for publishing, regardless of account-level or package-level 2FA settings
+- As of August 2026, bypass 2FA token cannot be used for account-identity or organization-governance actions. Those actions always require an interactive 2FA challenge. For more information, see "[About access tokens](/about-access-tokens#account-identity-actions-require-an-interactive-2fa-challenge)."
 - When **Require two-factor authentication and disallow tokens** is selected at the package level, granular access tokens cannot be used regardless of their bypass 2FA setting
 
 </Note>