diff --git a/lib/utils/web-auth.js b/lib/utils/web-auth.js
index b995998809c43..ce551687098fc 100644
--- a/lib/utils/web-auth.js
+++ b/lib/utils/web-auth.js
@@ -10,7 +10,7 @@ async function webAuth (opener, initialUrl, doneUrl, opts) {
       // cancel open prompt if it's present
       doneEmitter.emit('abort')
 
-      return authResult
+      return authResult.token
     })
 
   await openPromise
diff --git a/test/lib/utils/web-auth.js b/test/lib/utils/web-auth.js
new file mode 100644
index 0000000000000..ee8a17ecbc09d
--- /dev/null
+++ b/test/lib/utils/web-auth.js
@@ -0,0 +1,32 @@
+const t = require('tap')
+
+const webAuthCheckLogin = async () => {
+  return { token: 'otp-token' }
+}
+
+const webauth = t.mock('../../../lib/utils/web-auth.js', {
+  'npm-profile': { webAuthCheckLogin },
+})
+
+const initialUrl = 'https://example.com/auth'
+const doneUrl = 'https://example.com/done'
+const opts = {}
+
+t.test('returns token on success', async (t) => {
+  const opener = async () => {}
+  const result = await webauth(opener, initialUrl, doneUrl, opts)
+  t.equal(result, 'otp-token')
+})
+
+t.test('closes opener when auth check finishes', async (t) => {
+  const opener = (_url, emitter) => {
+    return new Promise((resolve, reject) => {
+      // the only way to finish this promise is to emit aboter on the emitter
+      emitter.addListener('abort', () => {
+        resolve()
+      })
+    })
+  }
+  const result = await webauth(opener, initialUrl, doneUrl, opts)
+  t.equal(result, 'otp-token')
+})