# npm "403 Forbidden" on Install - Fix Blocked Registry Reads in CI

> Fix npm "E403 403 Forbidden" while installing in CI - a registry or proxy refusing a read your token is not allowed to make, a blocked package, or an IP/policy restriction.

Source: https://latchkey.dev/learn/node-js/npm-e403-forbidden-install  
Updated: 2026-06-25

A 403 on install (not publish) means the registry authenticated the request but refused the read. The token is valid, but policy - a blocked package, an entitlement, or a proxy rule - forbids fetching it.

## Diagnose it: which registry, and with what credentials?

Registry errors are resolved in a precedence chain, and the effective value is rarely the one in the file you are looking at. Scoped registries, `.npmrc` files at several levels, and environment variables all combine before a request is made.

```Terminal
# the effective, fully merged configuration
npm config list -l | grep -E "registry|_auth|always-auth"

# where each value came from
npm config get registry
npm config get @yourscope:registry

# prove the token works, independently of the install
curl -sI -H "Authorization: Bearer $NPM_TOKEN" \
  "$(npm config get registry)@yourscope%2fpackage" | head -1
```

> A private package 404s rather than 401s when the token lacks read access, because the registry will not confirm that a package you cannot see exists. Treat an unexpected 404 on a private scope as an auth problem, not a missing package.

## FAQ

### What causes npm "403 Forbidden" on install?

There are 2 common causes: the token lacks entitlement to read the package and a proxy or security policy blocks the package. On a private/proxy registry, a token may authenticate but not be entitled to a particular scope or package, so reads return 403.

### How do I fix npm "403 Forbidden" on install?

There are 2 fixes depending on which cause you have: use a token entitled for the scope and check proxy/policy rules. Work through them in order, since the first is the most common.

### What does npm "403 Forbidden" on install actually mean?

npm install/npm ci fails with E403 403 Forbidden - GET for a package, even though authentication succeeds for other packages.

### How do I stop npm "403 Forbidden" on install happening again?

Grant CI tokens read entitlement for every scope they install. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt