Restrict by source IP with: npm token create --cidr=<cidr-ranges>, e.g. --cidr=192.168.0.1/24 (repeatable for multiple ranges)
On success npm prints the new token once, e.g. 'Created publish token a73c9572-...' — capture it immediately and store securely, it is not shown again
For automation/CI use a scoped, least-privileged token: create a read-only token for installs or a publish token only where publishing is required
Known gotchas
The CLI cannot generate automation tokens (tokens with npm automation access) — those must be created on the npmjs.com website under Account settings; the CLI-created token will not work for fully-automated publishes that bypass the web
The full token is only shown once at creation, so save it somewhere safe (e.g. a secret manager) before closing the session
--cidr whitelists the token to the listed IP ranges; requests from outside those ranges are rejected, so do not add a range your CI's egress IP is not inside
Creating a token requires the account password and, with 2FA, an OTP — headless scripts cannot create tokens without those
Give your agent this knowledge — and 16,900+ more routes
One MCP install gives any agent live access to the full route map across 5,900+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?