Publish a private npm package

Set the package name and registry

Create a shared scope or private registry first. In your package's package.json, use a name you own, such as @acme/sdk, and a new version. Published version contents are immutable, and an unpublished version number cannot be reused.

For a shared scope, put this in the publisher's project .npmrc. Supply the secret as an environment variable rather than committing it:

@acme:registry=https://registry.privatenpm.com/
//registry.privatenpm.com/:_authToken=${PUBLISHER_KEY}

The scope route keeps public dependencies on npmjs.org. The //registry.privatenpm.com/:_authToken host must match the registry URL. For a private registry, use its active custom hostname in both lines. Keep the key in your shell or CI secret store; do not commit its value.

Issue a publisher key and publish

1. On the registry card, choose Manage keys → New publisher key. Issue it for your user or CI pipeline. Select the package:publish action and limit the key to the package or scope your release needs. Save the reveal-once prt_… secret.
2. Set PUBLISHER_KEY in your shell or CI secret store, then run npm publish from the package directory.
3. Open Registry → Packages to confirm the version and dist-tag. For a clean install test, issue a separate download key and use it with the install configuration.

If npm rejects the publish, check the package name, registry host, publisher key audience and actions, and whether your organization has a card on file during its trial. A download key is read-only and cannot publish. For an unscoped package on a private registry, use registry=https://npm.acme.com/ in that project's .npmrc or pass --registry=https://npm.acme.com/ to npm publish; the default-registry setting also sends public dependencies to that host.