# X_TRUST_2FA_REQUIRED

## Means

npm refused the trust change on the credential's class

## Typical cause

a granular access token that bypasses two-factor auth — attaching a publisher is an account-level trust change, so npm requires a session that carries 2FA, and no OTP flag rescues a bypass token

## Fix

`npm login`, then `bun run scripts/trust-publishers.ts`

[CLI and verify](/error-codes#cli-and-verify)