# npm .npmrc Auth Token in CI - Configure Registry Credentials Safely

> Configure the npm .npmrc auth token in CI so private installs authenticate, injecting the token from a secret instead of committing it to the repo.

Source: https://latchkey.dev/learn/node-js/npmrc-auth-token-in-ci  
Updated: 2026-06-26

Private installs need an _authToken in .npmrc. In CI the token must come from a secret and the variable in .npmrc must actually expand, or npm sends the literal placeholder and auth fails.

## Diagnose it: which registry, and with what credentials?

Registry errors are resolved in a precedence chain, and the effective value is rarely the one in the file you are looking at. Scoped registries, `.npmrc` files at several levels, and environment variables all combine before a request is made.

```Terminal
# the effective, fully merged configuration
npm config list -l | grep -E "registry|_auth|always-auth"

# where each value came from
npm config get registry
npm config get @yourscope:registry

# prove the token works, independently of the install
curl -sI -H "Authorization: Bearer $NPM_TOKEN" \
  "$(npm config get registry)@yourscope%2fpackage" | head -1
```

> A private package 404s rather than 401s when the token lacks read access, because the registry will not confirm that a package you cannot see exists. Treat an unexpected 404 on a private scope as an auth problem, not a missing package.

## FAQ

### What causes npm .npmrc auth token in CI?

There are 2 common causes: the token variable was not expanded and no token secret is available in ci. A committed .npmrc referencing an env-var token is only expanded when the value is written via the shell or npm config sees the env var; otherwise the literal placeholder string is sent.

### How do I fix npm .npmrc auth token in CI?

There are 2 fixes depending on which cause you have: write the token from a secret at runtime and pass the secret through the env. Work through them in order, since the first is the most common.

### What does npm .npmrc auth token in CI actually mean?

Private package installs fail with 401/403, or npm sends the unexpanded token placeholder verbatim because the .npmrc variable was never expanded by the shell or by npm config.

### How do I stop npm .npmrc auth token in CI happening again?

Keep the token in CI secrets, write or expand it into .npmrc at runtime, and add .npmrc token lines to .gitignore so a credential never lands in source control.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt