Configure .npmrc for a private npm registry

Route a scope to the registry

Put an .npmrc file in the project that installs the private package. For a scope on the shared registry, use your reserved scope in place of @acme:

@acme:registry=https://registry.privatenpm.com/
//registry.privatenpm.com/:_authToken=${ACME_NPM_TOKEN}

Set ACME_NPM_TOKEN to the download key in your shell or CI secret store. npm expands ${ACME_NPM_TOKEN} when reading this file. Keep the actual secret out of source control. The auth line starts with //, omits https:, and uses the same host as the registry URL. Put the file beside your project's package.json; the scope mapping leaves ordinary public packages on npmjs.org.

Use your own registry domain

For a private registry on a verified custom domain, point the scope to that host instead:

@acme:registry=https://npm.acme.com/
//npm.acme.com/:_authToken=${ACME_NPM_TOKEN}

Wait for the custom domain to become active before using it. Set ACME_NPM_TOKEN to a read-only download key for installs. Give each customer or integration its own key so you can change access or revoke one recipient without disrupting others. Publishers should use a separate publisher key.

Install an unscoped package

For an unscoped private package, set the project's default registry instead of a scope mapping:

registry=https://npm.acme.com/
//npm.acme.com/:_authToken=${ACME_NPM_TOKEN}

This sends public dependencies to that host too. Use this only in projects that need it, or pass --registry=https://npm.acme.com/ to a specific npm command. The registry URL and auth host must change together if you move the domain.

Check the install path

1. In a fresh environment, set the token variable and run npm install @acme/sdk from the project directory.
2. If npm returns 401 or 403, check the token, its package grant, and the host on the auth line.
3. If npm cannot find the package, check the scope, registry URL, and published package name.
4. In CI, add the token as a protected secret and keep the same .npmrc mapping in the build workspace.

pnpm also reads npm-style registry configuration. Current Yarn releases use .yarnrc.yml with npmScopes and npmAuthToken instead; see Yarn's registry settings. For npm's exact file and token rules, see the npm documentation. Learn how private registries handle access and review the security model.