[QUESTIONS and NOTES] Granular Access Tokens

[AviVahl]

1. I can generate them in the website. Then it lets me copy them from the webpage. Am I expected to set the ~/.npmrc file manually? npm login used to set this up for me. The docs have no clear section about "Using granular access tokens". Only about creating and viewing them.
2. According to the docs, the CLI cannot create such tokens. Is this still true as of 11.7.0? (aka I see a npm token create command)
3. Is the "Bypass 2FA" only for tokens with write access? If so, the token creation page isn't clear about that.
4. While write-allowed tokens have maximum of 90 days until expiration, read-only ones appear to not be limited this way (I can create tokens 1 year forward). Not super clear from the documentation and token creating page.
5. At the end of the blog post there's a small note about current tokens (ones that npm login creates) being limited to two hours. This was not clear at all and is easy to miss. Can the CLI be clear about that when creating such tokens?

[robations]

At the end of the blog post there's a small note about current tokens (ones that npm login creates) being limited to two hours. This was not clear at all and is easy to miss. Can the CLI be clear about that when creating such tokens?

I'm confused about this too. I seem to have to re-login on a frequent basis just to run a regular read/install activities (for any projects with private packages). Surely this isn't how it's supposed to work?

[muhroots]

Everything is very confusing. I'm having a lot of difficulty publishing my packages on npm using the command line.

[guest271314]

Hmm, how to bypass the 2fa thing?

[guest271314]

Alright, I created to "Access Token", with "Bypass two-factor authentication (2FA)" on the NPM Web site. I then created an .npmrc file in the local folder including only this

//registry.npmjs.org/:_authToken=npm_...

then

npm login --auth-type=legacy