[BUG] Automating clean up of expired tokens with npm token list
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
The input for npm token revoke requests either id or token, but the list output does not include id a usable manner. Pls add id as id as a field to the json output, and name to npm token list.
The output from npm token list has the fields ( ID available, but name isn't )
Token npm_NYn6...jCq0… with id d83cf1 created 2026-05-29
Output from npm token list --parseable
key token created readonly CIDR whitelist
*** npm_NYn6...jCq0 2025-05-28T12:22:18.350Z false
And the out from npm token list --json has the fields ( Name available, but ID isn't )
{
"name": "publish_token",
"description": "Publish Token",
"key": "***",
"token": "npm_NYn6...jCq0",
"expiry": "2026-02-03T20:06:18.920Z",
"cidr": [],
"bypass_2fa": true,
"revoked": null,
"created": "2025-05-28T12:22:18.350Z",
"updated": "2025-11-05T20:06:18.920Z",
"accessed": "2026-02-02T08:21:34.208Z",
"permissions": [
{
"name": "package",
"action": "write"
}
],
"scopes": [
{
"name": "a_test_package",
"type": "package"
}
]
}
Expected Behavior
Pls add id as id as a field to the json output, and name to npm token list.
Steps To Reproduce
npm token list
npm token list --parseable
npm token list --json
Environment
- npm -v 11.16.0
- node -v v24.15.0
- OS Name: MacOs 26.5
- System Model Name: Mac mini M4
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the entry points for npm token list, npm token list --parseable, and npm token list --json, then compare their current fields with the examples in the issue. Done means the JSON output includes the token id and the regular list output includes the token name, with the relevant command outputs covered by tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- authentication, cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100