NPM trusted publishing fails: Access token expired or revoked. Please try logging in again.

[MaddyGuthridge]

Select Topic Area

Question

Body

I've been trying for the past 2 hours to convince my npm publish workflow to operate correctly, but it simply fails to work with every change I have tried. I have:

• Edited my workflow to npm i -g npm@^11.5.1
• Added flags to enable provenance, as this commenter said that without these flags, the publish operation failed, despite the documentation claiming that this was enabled by default.
• Switched to Node 24, as this commenter suggested that v22 did not work.
• Triple-checked all of the configurations on NPM and on GitHub.

Despite all of this, the workflow fails, stating: Access token expired or revoked. Please try logging in again.

This error makes no sense, because I am not using an access token at all, and this (brand new) repository never had one configured. Isn't the whole point of trusted publishing that I don't need to log in with a token?

For reference:

• The repository: https://github.com/MaddyGuthridge/marked-abc
• The publish workflow file: https://github.com/MaddyGuthridge/marked-abc/blob/a9708d072b7c17aa552b53e03863b28a181929cc/.github/workflows/publish.yml
• The failed publish workflow run: https://github.com/MaddyGuthridge/marked-abc/actions/runs/22486698712/job/65137999816
• My settings on NPM:

This has been an incredibly frustrating experience. Any suggestions are appreciated.

[pratikrath126]

With trusted publishing, GitHub uses OIDC to authenticate automatically, so no token is needed in the workflow. The error usually means the repository hasn't been properly linked in the npm package settings. Go to your npm package → Settings → GitHub → connect repository and enable Allow GitHub Actions. Also ensure your workflow has: permissions: packages: write (or contents: write). Use npm@^9. Provenance can cause issues; try adding --provenance=false or upgrade to npm@latest. After linking, the error should resolve.