It's great for security generally, but also particularly useful if you maintain any npm packages, as it removes the main downside of automating npm publishing, by allowing you to give CI jobs only a very limited token instead of full 2FA-free access to your account. as the secret name Copy the npm_... token from the previous step as the secret value In your npm package's settings (i.e. https://www.npmjs.com/package/$PACKAGE_NAME/access ), allow publish without 2FA for granular/automation tokens only, so that tokens can be used for publishing: Add a publish step to your GitHub actions script.