[BUG] Misleading 401 "npm tokens that bypass 2FA are being restricted" error when using a token that doesn't bypass 2FA

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

When I use an NPM_TOKEN=... for npm trust, it errors out with 401 "npm tokens that bypass 2FA are being restricted" even though my explicitly created my token to not bypass 2FA. Apparently, I just can't use any granular access token for that process, but the error message doesn't make that clear.

Expected Behavior

When I use an NPM_TOKEN that doesn't bypass 2FA, npm cli commands would prompt me for 2FA instead of erroring out.

Or, the error message would actually explain the situation accurately, for example:

• For processes that still allow 2FA to be bypassed: "this process requires 2FA, so it can't be performed with a granular access token provided via environment variables or npm config, unless that access token is configured to bypass 2FA"
• For processes that don't allow 2FA to be bypassed: "this process requires 2FA and doesn't allow granular access tokens to bypass it, so it can't be performed with a granular access token provided via environment variables or npm config. Instead you must use a short-lived token from npm login or OIDC trusted publishing."

Steps To Reproduce

1. Enable 2FA in your NPM account
2. Create an NPM token with permission to write any package, without checking bypass 2FA
3. Run NPM_TOKEN=<the token> npm trust circleci ...
4. See:
   npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
   npm error code E401
   npm error 401 Unauthorized - POST https://registry.npmjs.org/-/package/@jcoreio%2fbatch-loader/trust

This isn't a token that bypasses 2FA, so this error message does a poor job of explaining the situation.

Environment

• npm: 11.15.0
• Node.js: N/A
• OS Name: N/A
• System Model Name: N/A
• npm config:

Nothing but `NPM_TOKEN` provided via env var

Start with the npm trust command and reproduce the 401 using NPM_TOKEN as described, with 2FA enabled and a granular token that does not bypass it. Trace where the "npm tokens that bypass 2FA are being restricted" notice is selected for this request. Done means the command prompts for 2FA when appropriate or reports accurately why the token cannot be used.