npm ERR! code EOTP after npm publish: diagnose the 403 before rotating credentials

[b-hash88]

Exact failure

npm ERR! code EOTP
npm ERR! This operation requires a one-time password from your authenticator.

The same policy can surface as a registry 403 saying that two-factor authentication or an authorized publishing path is required.

Free diagnosis

This is narrower than a generic login failure. npm currently requires one of the publishing paths allowed by the package and account configuration:

• Interactive local publish: complete the 2FA challenge for that publish. Treat the OTP as a secret: do not place it in source, CI configuration, issue text, agent prompts, or logs.
• Granular access token: it can publish only where package policy permits tokens; bypass-2FA is chosen when the token is created.
• Trusted publishing in CI: use the configured OIDC publisher instead of adding an OTP or long-lived write token to the workflow. npm documents npm CLI 11.5.1+ and Node 22.14.0+ for this path.
• Package policy disallows tokens: a granular token will not solve the failure. Use interactive 2FA or the package's configured trusted-publishing path.

Before changing credentials, classify the failing environment as local interactive or CI, and check the package's Publishing access policy. After a successful publish, verify the exact version and registry hashes:

npm view <package>@<version> version dist.integrity dist.shasum --json

Reproducible references

• Crawlable diagnosis and checkout: https://b-hash88.github.io/knownfix/fixes/npm-publish-2fa-403.html
• Agent-readable Markdown: https://b-hash88.github.io/knownfix/fixes/npm-publish-2fa-403.md
• Six-fix recovery pack outline and checkout: https://b-hash88.github.io/knownfix/packs/npm-publishing-recovery-pack.html
• No-account MCP/CLI search: npx -y knownfix@0.3.16 search "npm ERR! code EOTP"
• npm 2FA publishing requirements: https://docs.npmjs.com/requiring-2fa-for-package-publishing-and-settings-modification/
• npm trusted publishing: https://docs.npmjs.com/trusted-publishers/
• npm CLI EOTP error contract: https://github.com/npm/cli/blob/81a901c9a5913f9bd8104e6196af3580eafa13cb/lib/utils/error-message.js

The free section above is enough to choose the correct authentication branch. The paid KnownFix entry adds the branch-by-branch recovery and verification sequence; the six-fix npm Publishing Recovery Pack is the larger option for repeated release failures. Test every claim against your package policy and registry readback.

[b-hash88]

Maintainer update: 0.3.17

The package and registry path described above has been refreshed:

• knownfix@0.3.17 is now npm latest.
• npx -y knownfix@0.3.17 search --json "npm ERR! code EOTP" returns the complete machine-readable search_fixes result, including a paid match's private signed USDC/ETH checkout and single redemption action.
• Default terminal output still withholds the bearer offer and now gives one direct MCP next action; it no longer asks buyers to discover get_offer.
• Official MCP Registry server 0.3.20 now points to npm 0.3.17, and the deployed MCP handshake reports the same server version.

The publish was read back from npm after processing. Its public shasum is 976708bf4a75523dc11905b1275cb4e17fbf210b, matching the pre-publish package dry run. Keep --json output private because it can contain a live signed purchase token.

Release note: https://github.com/b-hash88/knownfix-cli/releases/tag/v0.3.17