# CircleCI and npm Trusted Publishing **URL:** \ **Category:** Notices\ **Tags:** security\ **Created:** [December 8, 2025, 11:51pm UTC](https://discuss.circleci.com/t/circleci-and-npm-trusted-publishing/54261 "2025-12-08T23:51:09Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![kami](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/kami/32/35940_2.png) [@kami](https://discuss.circleci.com/u/kami)\ **Post date:** [December 8, 2025, 11:51pm UTC](https://discuss.circleci.com/t/circleci-and-npm-trusted-publishing/54261/1 "2025-12-08T23:51:09Z")
Github/npm has announced security changes that take effect on December 9, 2025. These changes include the deprecation of classic tokens and a 90-day maximum lifetime for granular access write tokens used in publishing workflows. Note, read-only tokens do not have a 90-day maximum. What’s Changing GitHub/npm is transitioning to a more secure publishing model with three primary options: - Local publishing with required 2FA - Granular write tokens (90-day maximum lifetime, requiring regular rotation) - Trusted publishing via OIDC (currently supporting only GitHub Actions and GitLab CI/CD) CircleCI’s Status and Readiness CircleCI has been actively working with GitHub/npm to become an approved trusted publisher. We have updated our OIDC implementation to have parity with what’s needed based on current trusted publishers. We are ready to integrate when approval is granted. Based on GitHub/npm’s projections, this may occur in Q1, 2026. What This Means for You If you publish npm packages using CircleCI, you’ll need to use granular access tokens with write permissions that must be rotated every 90 days until trusted publishing support is available. How to set up granular tokens: 1. Visit [npmjs.com/settings/~/tokens](https://www.npmjs.com/settings/~/tokens) 2. Click “Generate New Token” → “Granular Access Token” 3. Configure appropriate permissions for your packages 4. Store the token in CircleCI as an environment variable 5. Set a reminder to rotate the token before it expires (90 days) If you need to only read private packages, you can set a custom expiry date far in the future when generating a read only token. The security of the npm ecosystem is critical, and we support GitHub’s goals. We also believe that the stewardship of open-source infrastructure like npm should include equitable access for all CI/CD providers. We will continue advocating for CircleCI’s inclusion as a trusted publisher while ensuring you have the tools and support needed to [publish securely](https://openjsf.org/blog/publishing-securely-on-npm). We’ll update this post as we receive more information from GitHub/npm. ---
**Author:** ![marksreid-displayr](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/marksreid-displayr/32/36897_2.png) [@marksreid-displayr](https://discuss.circleci.com/u/marksreid-displayr)\ **Post date:** [February 3, 2026, 10:39pm UTC](https://discuss.circleci.com/t/circleci-and-npm-trusted-publishing/54261/2 "2026-02-03T22:39:26Z")
Is there any update here? This is becoming an issue, all of the manual token rotation is a chore that we’d prefer not to have. ---
**Author:** ![kami](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/kami/32/35940_2.png) [@kami](https://discuss.circleci.com/u/kami)\ **Post date:** [February 23, 2026, 8:37pm UTC](https://discuss.circleci.com/t/circleci-and-npm-trusted-publishing/54261/3 "2026-02-23T20:37:19Z")
I apologize for the delayed reply. Unfortunately, we do not have an update. We are still working with all stakeholders to improve the experience, and will share when we have a change in status. ---
**Author:** ![vsrivastav-pm](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/vsrivastav-pm/32/26823_2.png) [@vsrivastav-pm](https://discuss.circleci.com/u/vsrivastav-pm)\ **Post date:** [April 1, 2026, 12:57pm UTC](https://discuss.circleci.com/t/circleci-and-npm-trusted-publishing/54261/4 "2026-04-01T12:57:47Z")
> [@marksreid-displayr](#): > > Is there any update here? This is becoming an issue, all of the manual token rotation is a chore that we’d prefer not to have. following up on previous comment, is there any update here? ---
**Author:** ![MikeMcC399](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/mikemcc399/32/35377_2.png) [@MikeMcC399](https://discuss.circleci.com/u/MikeMcC399)\ **Post date:** [April 14, 2026, 7:09am UTC](https://discuss.circleci.com/t/circleci-and-npm-trusted-publishing/54261/5 "2026-04-14T07:09:24Z")
GitHub blog [npm trusted publishing now supports CircleCI](https://github.blog/changelog/2026-04-06-npm-trusted-publishing-now-supports-circleci/) dated April 6, 2026 announces this support. ---
**Author:** ![rachael](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/rachael/32/26790_2.png) [@rachael](https://discuss.circleci.com/u/rachael)\ **Post date:** [June 10, 2026, 9:26pm UTC](https://discuss.circleci.com/t/circleci-and-npm-trusted-publishing/54261/6 "2026-06-10T21:26:41Z")
**Update:** CircleCI is now an officially supported npm Trusted Publisher! We’ve posted a follow-up with the full details, including an onboarding tool that handles both single project and bulk setup to take the pain out of the UUID lookup process. [Check out the update here.](https://discuss.circleci.com/t/npm-trusted-publishing-with-circleci-improvements/54645) ---
**Author:** ![rachael](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/rachael/32/26790_2.png) [@rachael](https://discuss.circleci.com/u/rachael)\ **Post date:** [June 10, 2026, 9:27pm UTC](https://discuss.circleci.com/t/circleci-and-npm-trusted-publishing/54261/7 "2026-06-10T21:27:31Z")
Hello there! We have a [new update here](https://discuss.circleci.com/t/npm-trusted-publishing-with-circleci-improvements/54645). Thank you for your patience. ---
**Author:** ![rachael](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/rachael/32/26790_2.png) [@rachael](https://discuss.circleci.com/u/rachael)\ **Post date:** [June 10, 2026, 9:27pm UTC](https://discuss.circleci.com/t/circleci-and-npm-trusted-publishing/54261/8 "2026-06-10T21:27:56Z")
Hello there! We have a [new update here](https://discuss.circleci.com/t/npm-trusted-publishing-with-circleci-improvements/54645). Thank you for your patience.