Last used for tokens field missing in npm APIs/cli

[carldemic]

Select Topic Area

Question

Body

The web interface has the "last used" field in the https://www.npmjs.com/settings/{username}/tokens/ page but the last used field is missing in npm token list from CLI or via the APIs.

This probably requires an update to the API as it doesn't return that field, but I'm not sure where to open that ticket.

[4syr]

Response to Issue #181140

Last Used Field Missing in npm APIs/CLI

---

Hi there,

Thank you for reporting this issue. You've identified an important gap between the npm web interface and the CLI/API functionality.

Issue Overview

The "last used" field for tokens is currently:

• ✅ Available on the web interface (https://www.npmjs.com/settings/{username}/tokens/)
• ❌ Missing in npm token list CLI command
• ❌ Missing in npm API responses

Recommended Actions

Since this appears to be an npm-specific API limitation, I'd suggest the following steps:

1. Open an issue in the official npm CLI repository

   • Repository: https://github.com/npm/cli
   • This is the appropriate channel for npm API feature requests

2. Before creating a new issue:

   • Search existing issues to avoid duplicates
   • Check if there's already a related feature request

3. When creating your issue, include:

   • Clear description of the missing field
   • Your use case (why this field is important)
   • Reference to this discussion for additional context

Why This Matters

Having the "last used" field accessible via CLI/API would be valuable for:

• Security auditing
• Token lifecycle management
• Automated monitoring systems

Additional Resources

• npm CLI Issues: https://github.com/npm/cli/issues
• npm API Documentation: https://docs.npmjs.com/

---

Hope this helps guide you to the right place for this request!

Best regards,
Asyrafi

[carldemic]

I already did that (npm/cli#8827 (comment)), they don't manage the website but just the cli tool. This issue depends on the backend API not exposing this field. Who should I reach out to? Thanks!

[4syr]

I already did that (npm/cli#8827 (comment)), they don't manage the website but just the cli tool. This issue depends on the backend API not exposing this field. Who should I reach out to? Thanks!

Response to Issue #181140 - Last Used Field Missing in npm APIs/CLI

---

Hi @carldemic,

Thank you for the follow-up and for your proactive efforts in reaching out to the npm CLI team first.

Understanding the Issue

You're correct that this requires a backend API update, as the CLI tool itself cannot expose data that isn't provided by the upstream API. Since the npm CLI team has redirected you, here are the appropriate channels to escalate this request:

Recommended Contact Channels

1. npm Support (Primary Channel)

• Contact: [email protected]
• Purpose: Backend API feature requests and functionality gaps
• What to include:
  • Clear description of the missing "last used" field in API responses
  • Reference to your CLI issue ([Projects] Bug: iteration won't allow skipping weeks (e.g. for holiday) #8827)
  • Your use case and business justification
  • Link to this discussion for context

2. npm Registry Repository

• Repository: https://github.com/npm/registry
• Note: While primarily for registry-specific issues, backend API concerns are sometimes tracked here. Check existing issues before creating a new one.

3. npm RFCs (For Formal Feature Proposals)

• Repository: https://github.com/npm/rfcs
• Purpose: Formal feature requests that require architectural changes
• Best for: If this requires significant API design considerations

Suggested Approach

I recommend starting with [email protected] as they have direct access to the backend API team. In your email, clearly outline:

• The discrepancy between web UI and API functionality
• The security and operational benefits of having this field accessible via API
• Reference to your previous attempts to resolve this through appropriate channels

Additional Context

This is indeed an important feature for:

• Automated security auditing
• Token lifecycle management
• Compliance monitoring
• Integration with third-party security tools

---

Best regards,
Asyrafi