fix!: remove npm adduser command

owlstronaut · owlstronaut · commit 7357d7fd82a6 · 2026-04-15T09:18:23.000-07:00
BREAKING CHANGE: The `npm adduser` command has been removed. Create and manage user accounts on the npm website, and use `npm login` to authenticate on the command line.
diff --git a/docs/lib/content/commands/npm-adduser.md b/docs/lib/content/commands/npm-adduser.md
diff --git a/docs/lib/content/commands/npm-deprecate.md b/docs/lib/content/commands/npm-deprecate.md
@@ -28,7 +28,7 @@ npm deprecate my-thing@1.x "1.x is no longer supported"
 In this case, a version `my-thing@1.0.0-beta.0` will also be deprecated.
 
 You must be the package owner to deprecate something.
-See the `owner` and `adduser` help topics.
+See the `owner` and `login` help topics.
 
 To un-deprecate a package, specify an empty string (`""`) for the `message` argument.
 Note that you must use double quotes with no space between them to format an empty string.
@@ -43,4 +43,4 @@ Note that you must use double quotes with no space between them to format an emp
 * [npm publish](/commands/npm-publish)
 * [npm registry](/using-npm/registry)
 * [npm owner](/commands/npm-owner)
-* [npm adduser](/commands/npm-adduser)
+* [npm login](/commands/npm-login)
diff --git a/docs/lib/content/commands/npm-logout.md b/docs/lib/content/commands/npm-logout.md
@@ -24,7 +24,7 @@ If `--scope` is provided, this will find the credentials for the registry connec
 
 ### See Also
 
-* [npm adduser](/commands/npm-adduser)
+* [npm login](/commands/npm-login)
 * [npm registry](/using-npm/registry)
 * [npm config](/commands/npm-config)
 * [npm whoami](/commands/npm-whoami)
diff --git a/docs/lib/content/commands/npm-owner.md b/docs/lib/content/commands/npm-owner.md
@@ -35,4 +35,4 @@ If you have two-factor authentication enabled with `auth-and-writes` (see [`npm-
 * [npm profile](/commands/npm-profile)
 * [npm publish](/commands/npm-publish)
 * [npm registry](/using-npm/registry)
-* [npm adduser](/commands/npm-adduser)
+* [npm login](/commands/npm-login)
diff --git a/docs/lib/content/commands/npm-profile.md b/docs/lib/content/commands/npm-profile.md
@@ -55,7 +55,7 @@ Some of these commands may not be available on non npmjs.com registries.
 
 ### See Also
 
-* [npm adduser](/commands/npm-adduser)
+* [npm login](/commands/npm-login)
 * [npm registry](/using-npm/registry)
 * [npm config](/commands/npm-config)
 * [npmrc](/configuring-npm/npmrc)
diff --git a/docs/lib/content/commands/npm-publish.md b/docs/lib/content/commands/npm-publish.md
@@ -100,7 +100,7 @@ See [`package.json`](/configuring-npm/package-json) for more info on what can an
 * [npm-packlist package](http://npm.im/npm-packlist)
 * [npm registry](/using-npm/registry)
 * [npm scope](/using-npm/scope)
-* [npm adduser](/commands/npm-adduser)
+* [npm login](/commands/npm-login)
 * [npm owner](/commands/npm-owner)
 * [npm deprecate](/commands/npm-deprecate)
 * [npm dist-tag](/commands/npm-dist-tag)
diff --git a/docs/lib/content/commands/npm-star.md b/docs/lib/content/commands/npm-star.md
@@ -41,4 +41,4 @@ You can see all your starred packages using [`npm stars`](/commands/npm-stars)
 * [npm stars](/commands/npm-stars)
 * [npm view](/commands/npm-view)
 * [npm whoami](/commands/npm-whoami)
-* [npm adduser](/commands/npm-adduser)
+* [npm login](/commands/npm-login)
diff --git a/docs/lib/content/commands/npm-stars.md b/docs/lib/content/commands/npm-stars.md
@@ -24,4 +24,4 @@ You may also want to see your friend's favorite packages, in this case you will
 * [npm unstar](/commands/npm-unstar)
 * [npm view](/commands/npm-view)
 * [npm whoami](/commands/npm-whoami)
-* [npm adduser](/commands/npm-adduser)
+* [npm login](/commands/npm-login)
diff --git a/docs/lib/content/commands/npm-token.md b/docs/lib/content/commands/npm-token.md
@@ -34,7 +34,7 @@ A revoked token will immediately be removed from the registry and you will no lo
 
 ### See Also
 
-* [npm adduser](/commands/npm-adduser)
+* [npm login](/commands/npm-login)
 * [npm registry](/using-npm/registry)
 * [npm config](/commands/npm-config)
 * [npmrc](/configuring-npm/npmrc)
diff --git a/docs/lib/content/commands/npm-unpublish.md b/docs/lib/content/commands/npm-unpublish.md
@@ -18,7 +18,7 @@ Consider using the [`deprecate`](/commands/npm-deprecate) command instead, if yo
 
 This removes a package version from the registry, deleting its entry and removing the tarball.
 
-The npm registry will return an error if you are not [logged in](/commands/npm-adduser).
+The npm registry will return an error if you are not [logged in](/commands/npm-login).
 
 If you do not specify a package name at all, the name and version to be unpublished will be pulled from the project in the current directory.
 
@@ -38,6 +38,5 @@ If you unpublish the entire package, you may not publish any new versions of tha
 * [npm deprecate](/commands/npm-deprecate)
 * [npm publish](/commands/npm-publish)
 * [npm registry](/using-npm/registry)
-* [npm adduser](/commands/npm-adduser)
 * [npm owner](/commands/npm-owner)
-* [npm login](/commands/npm-adduser)
+* [npm login](/commands/npm-login)
diff --git a/docs/lib/content/commands/npm-unstar.md b/docs/lib/content/commands/npm-unstar.md
@@ -34,5 +34,5 @@ You can see all your starred packages using [`npm stars`](/commands/npm-stars)
 * [npm stars](/commands/npm-stars)
 * [npm view](/commands/npm-view)
 * [npm whoami](/commands/npm-whoami)
-* [npm adduser](/commands/npm-adduser)
+* [npm login](/commands/npm-login)
 
diff --git a/docs/lib/content/commands/npm-whoami.md b/docs/lib/content/commands/npm-whoami.md
@@ -24,4 +24,4 @@ If logged into a registry that uses Basic Auth, then simply print the `username`
 
 * [npm config](/commands/npm-config)
 * [npmrc](/configuring-npm/npmrc)
-* [npm adduser](/commands/npm-adduser)
+* [npm login](/commands/npm-login)
diff --git a/docs/lib/content/commands/npm.md b/docs/lib/content/commands/npm.md
@@ -78,8 +78,8 @@ If you're using npm to develop and publish your code, check out the following he
 * install:
   It's a good idea to install things if you don't need the symbolic link.
   Especially, installing other peoples code from the registry is done via [`npm install`](/commands/npm-install)
-* adduser:
-  Create an account or log in.
+* login:
+  Log in to the registry and store credentials.
   When you do this, npm will store credentials in the user config file.
 * publish:
   Use the [`npm publish`](/commands/npm-publish) command to upload your code to the registry.
diff --git a/docs/lib/content/nav.yml b/docs/lib/content/nav.yml
@@ -12,9 +12,6 @@
   - title: npm access
     url: /commands/npm-access
     description: Set access level on published packages
-  - title: npm adduser
-    url: /commands/npm-adduser
-    description: Add a registry user account
   - title: npm audit
     url: /commands/npm-audit
     description: Run a security audit
diff --git a/docs/lib/content/using-npm/developers.md b/docs/lib/content/using-npm/developers.md
@@ -173,16 +173,7 @@ Then go into the node-repl, and try using require("my-thing") to bring in your m
 
 ### Create a User Account
 
-Create a user with the adduser command.
-It works like this:
-
-```bash
-npm adduser
-```
-
-and then follow the prompts.
-
-This is documented better in [npm adduser](/commands/npm-adduser).
+Create a user account on the [npm website](https://www.npmjs.com/signup).
 
 ### Publish your Package
 
@@ -211,5 +202,5 @@ Tell the world how easy it is to install your program!
 * [package.json](/configuring-npm/package-json)
 * [npm scripts](/using-npm/scripts)
 * [npm publish](/commands/npm-publish)
-* [npm adduser](/commands/npm-adduser)
+* [npm login](/commands/npm-login)
 * [npm registry](/using-npm/registry)
diff --git a/lib/commands/adduser.js b/lib/commands/adduser.js
diff --git a/lib/utils/auth.js b/lib/utils/auth.js
@@ -1,4 +1,4 @@
-const { webAuthOpener, adduserWeb, loginWeb, loginCouch, adduserCouch } = require('npm-profile')
+const { webAuthOpener, loginWeb, loginCouch } = require('npm-profile')
 const { log } = require('proc-log')
 const { createOpener } = require('../utils/open-url.js')
 const read = require('../utils/read-user-info.js')
@@ -32,42 +32,6 @@ const otplease = async (npm, opts, fn) => {
   }
 }
 
-const adduser = async (npm, { creds, ...opts }) => {
-  const authType = npm.config.get('auth-type')
-  let res
-  if (authType === 'web') {
-    try {
-      res = await adduserWeb(createOpener(npm, 'Create your account at'), opts)
-    } catch (err) {
-      if (err.code === 'ENYI') {
-        log.verbose('web add user not supported, trying couch')
-      } else {
-        throw err
-      }
-    }
-  }
-
-  // auth type !== web or ENYI error w/ web adduser
-  if (!res) {
-    const username = await read.username('Username:', creds.username)
-    const password = await read.password('Password:', creds.password)
-    const email = await read.email('Email (this will be public):', creds.email)
-    // npm registry quirk:
-    // If you "add" an existing user with their current password, it's effectively a login, and if that account has otp you'll be prompted for it.
-    res = await otplease(npm, opts, (reqOpts) => adduserCouch(username, email, password, reqOpts))
-  }
-
-  // We don't know the username if it was a web login, all we can reliably log is scope and registry
-  const message = `Logged in${opts.scope ? ` to scope ${opts.scope}` : ''} on ${opts.registry}.`
-
-  log.info('adduser', message)
-
-  return {
-    message,
-    newCreds: { token: res.token },
-  }
-}
-
 const login = async (npm, { creds, ...opts }) => {
   const authType = npm.config.get('auth-type')
   let res
@@ -102,7 +66,6 @@ const login = async (npm, { creds, ...opts }) => {
 }
 
 module.exports = {
-  adduser,
   login,
   otplease,
 }
diff --git a/lib/utils/cmd-list.js b/lib/utils/cmd-list.js
@@ -4,7 +4,6 @@ const abbrev = require('abbrev')
 // Please keep this list sorted alphabetically
 const commands = [
   'access',
-  'adduser',
   'audit',
   'bugs',
   'cache',
@@ -137,7 +136,7 @@ const aliases = {
   sit: 'install-ci-test',
   urn: 'run',
   ogr: 'org',
-  'add-user': 'adduser',
+
 }
 
 const deref = (c) => {
diff --git a/lib/utils/error-message.js b/lib/utils/error-message.js
@@ -267,7 +267,7 @@ const errorMessage = (er, npm) => {
 
     case 'ENEEDAUTH':
       summary.push(['need auth', er.message])
-      detail.push(['need auth', 'You need to authorize this machine using `npm adduser`'])
+      detail.push(['need auth', 'You need to authorize this machine using `npm login`'])
       break
 
     case 'ECONNRESET':
diff --git a/mock-registry/lib/index.js b/mock-registry/lib/index.js
@@ -228,27 +228,6 @@ class MockRegistry {
     }
   }
 
-  couchadduser ({ username, email, password, token = 'npm_default-test-token' }) {
-    this.nock = this.nock.put(this.fullPath(`/-/user/org.couchdb.user:${username}`), body => {
-      this.#tap.match(body, {
-        _id: `org.couchdb.user:${username}`,
-        name: username,
-        email, // Sole difference from couchlogin
-        password,
-        type: 'user',
-        roles: [],
-      })
-      if (!body.date) {
-        return false
-      }
-      return true
-    }).reply(201, {
-      id: 'org.couchdb.user:undefined',
-      rev: '_we_dont_use_revs_any_more',
-      token,
-    })
-  }
-
   couchlogin ({ username, password, token = 'npm_default-test-token' }) {
     this.nock = this.nock.put(this.fullPath(`/-/user/org.couchdb.user:${username}`), body => {
       this.#tap.match(body, {
diff --git a/smoke-tests/tap-snapshots/test/index.js.test.cjs b/smoke-tests/tap-snapshots/test/index.js.test.cjs
@@ -21,16 +21,15 @@ npm help npm       more involved overview
 
 All commands:
 
-    access, adduser, audit, bugs, cache, ci, completion,
-    config, dedupe, deprecate, diff, dist-tag, docs, doctor,
-    edit, exec, explain, explore, find-dupes, fund, get, help,
-    help-search, init, install, install-ci-test, install-test,
-    link, ll, login, logout, ls, org, outdated, owner, pack,
-    ping, pkg, prefix, profile, prune, publish, query, rebuild,
-    repo, restart, root, run, sbom, search, set, shrinkwrap,
-    star, stars, start, stop, team, test, token, trust,
-    undeprecate, uninstall, unpublish, unstar, update, version,
-    view, whoami
+    access, audit, bugs, cache, ci, completion, config,
+    dedupe, deprecate, diff, dist-tag, docs, doctor, edit, exec,
+    explain, explore, find-dupes, fund, get, help, help-search,
+    init, install, install-ci-test, install-test, link, ll,
+    login, logout, ls, org, outdated, owner, pack, ping, pkg,
+    prefix, profile, prune, publish, query, rebuild, repo,
+    restart, root, run, sbom, search, set, shrinkwrap, star,
+    stars, start, stop, team, test, token, trust, undeprecate,
+    uninstall, unpublish, unstar, update, version, view, whoami
 
 Specify configs in the ini-formatted file:
     {NPM}/{TESTDIR}/home/.npmrc
diff --git a/tap-snapshots/test/lib/commands/completion.js.test.cjs b/tap-snapshots/test/lib/commands/completion.js.test.cjs
@@ -61,11 +61,9 @@ exports[`test/lib/commands/completion.js TAP completion multiple command names >
 Array [
   String(
     access
-    adduser
     audit
     author
     add
-    add-user
   ),
 ]
 `
diff --git a/tap-snapshots/test/lib/commands/publish.js.test.cjs b/tap-snapshots/test/lib/commands/publish.js.test.cjs
@@ -153,7 +153,6 @@ Object {
   "main": "./index.js",
   "man": Array [
     "man/man1/npm-access.1",
-    "man/man1/npm-adduser.1",
     "man/man1/npm-audit.1",
     "man/man1/npm-bugs.1",
     "man/man1/npm-cache.1",
diff --git a/tap-snapshots/test/lib/docs.js.test.cjs b/tap-snapshots/test/lib/docs.js.test.cjs
diff --git a/tap-snapshots/test/lib/npm.js.test.cjs b/tap-snapshots/test/lib/npm.js.test.cjs
diff --git a/tap-snapshots/test/lib/utils/error-message.js.test.cjs b/tap-snapshots/test/lib/utils/error-message.js.test.cjs
diff --git a/test/lib/commands/adduser.js b/test/lib/commands/adduser.js
diff --git a/test/lib/commands/completion.js b/test/lib/commands/completion.js
