npm 403 Forbidden on Publish in CI - Fix Publish Permission Errors

By Kaveh Alemi·Latchkey

A 403 on npm publish means the registry accepted who you are but refused the action. The token may lack publish rights, the name may be taken, or the version may already exist.

What this error means

npm publish fails with 403 Forbidden. The token authenticated, but publishing is blocked because of access, an existing version, two-factor requirements, or a name owned by someone else.

npm

npm ERR! code E403
npm ERR! 403 403 Forbidden - PUT https://registry.npmjs.org/@acme%2fui
npm ERR! You cannot publish over the previously published versions: 1.4.0.

Diagnose it: which registry, and with what credentials?

Registry errors are resolved in a precedence chain, and the effective value is rarely the one in the file you are looking at. Scoped registries, .npmrc files at several levels, and environment variables all combine before a request is made.

Terminal

# the effective, fully merged configuration
npm config list -l | grep -E "registry|_auth|always-auth"

# where each value came from
npm config get registry
npm config get @yourscope:registry

# prove the token works, independently of the install
curl -sI -H "Authorization: Bearer $NPM_TOKEN" \
  "$(npm config get registry)@yourscope%2fpackage" | head -1

Common causes

The token lacks publish access

A read-only or under-scoped token cannot publish to the package or scope.

The version already exists or the name is taken

npm refuses to overwrite a published version, and you cannot publish a name owned by another account.

How to fix it

Use a publish-scoped token and bump the version

Issue an automation token with publish rights to the scope.
Bump the version so you are not republishing an existing one.

Terminal

npm version patch
npm publish --access public

Handle two-factor for publish

Use an automation token that bypasses interactive 2FA in CI.
Or supply the OTP via --otp when required.

How to prevent it

Publish with a dedicated automation token scoped to the package, bump the version every release, and confirm name ownership. A 403 reflects permissions or state, so retrying the same publish will not help.

Frequently asked questions

What causes npm 403 forbidden on publish in CI?

There are 2 common causes: the token lacks publish access and the version already exists or the name is taken. A read-only or under-scoped token cannot publish to the package or scope.

How do I fix npm 403 forbidden on publish in CI?

There are 2 fixes depending on which cause you have: use a publish-scoped token and bump the version and handle two-factor for publish. Work through them in order, since the first is the most common.

What does npm 403 forbidden on publish in CI actually mean?

npm publish fails with 403 Forbidden.

How do I stop npm 403 forbidden on publish in CI happening again?

Publish with a dedicated automation token scoped to the package, bump the version every release, and confirm name ownership.