From first package to reliable delivery.

Publish your first private package

Reserve a scope, publish a small JavaScript package and install the package in another project. No custom domain or build tools required.

What is a private npm registry?

A private npm registry stores your packages and checks a credential on each request. This guide explains the requests that npm sends and the checks that the registry does.

Create a private npm registry

Reserve a scope on the shared registry or create a private registry on your domain. Then create a publisher key and a download key, and publish the first version.

Publish a private npm package

Publish a scoped package with npm publish and a limited publisher key. Then confirm the version and give read-only access with a download key.

Authentication and troubleshooting

Configure .npmrc for a private npm registry

Add a scope route and a credential line to .npmrc, and keep the key in the environment. This guide gives the configuration for npm, pnpm, Yarn, GitHub Actions, CircleCI and Vercel.

Fix npm E401: private registry authentication

npm E401 means that the registry did not accept the credential of a request. Examine the registry host, the token variable and the key in that sequence.

CI and security

Review package security and connect deployment inventory

Watch an immutable npm release, review bounded static and advisory evidence, and connect authenticated deployment observations.

Self-hosted npm registry: what to plan for

A self-hosted npm registry gives you control, and your team operates each part of it. Plan storage, TLS, proxies, credentials, backups and upgrades before you start.

Verify a custom npm registry domain

Connect a hostname that you own to a private registry. A TXT record proves ownership, a CNAME record sends traffic to the edge, and the edge gets the certificate.

npm trusted publishing with OIDC

Publish private npm packages from GitHub Actions or GitLab CI with no stored publisher key. The CI job exchanges its OIDC token for a publisher key that expires after 15 minutes.

Cache public npm packages safely

Serve approved public npm packages from your registry URL. Hosted names and claimed scopes never resolve from the public registry.

Customer delivery

See private package downloads

Find the download numbers of each package, recipient and download key, and learn what each counter counts. Use the numbers to report recipient adoption.

Configure private registry webhooks

Send signed registry change events to your HTTPS server. Verify each signature and process each event one time.

Automate npm download keys after a sale

After a verified payment, your server creates the recipient, issues a download key for the purchased packages and sends the install instructions.

Recipient npm download portal

Invite one person at a recipient to manage their own download keys. A delegation key that you choose sets the packages and the expiry date of each key.