Configure .npmrc for a private npm registry

Route a scope to the registry

Put an .npmrc file in the project that installs the private package. For a scope on the shared registry, use your reserved scope in place of @acme:

@acme:registry=https://registry.privatenpm.com/
//registry.privatenpm.com/:_authToken=${ACME_NPM_TOKEN}

The token value should come from an environment variable. Keep the actual secret out of source control. The token line must match the registry host and path used by the scoped registry line.

Use your own registry domain

For a private registry on a verified custom domain, point the scope to that host instead:

@acme:registry=https://npm.acme.com/
//npm.acme.com/:_authToken=${ACME_NPM_TOKEN}

Set ACME_NPM_TOKEN to a read-only download key for installs. Give each customer or integration its own key so you can change access or revoke one recipient without disrupting others. Publishers should use a separate publisher key.

Check the install path

1. In a fresh environment, set the token variable and run npm install @acme/sdk from the project directory.
2. If npm returns 401 or 403, check the token, its package grant, and the host on the auth line.
3. If npm cannot find the package, check the scope, registry URL, and published package name.
4. In CI, add the token as a protected secret and keep the same .npmrc mapping in the build workspace.

pnpm also reads npm-style registry configuration. Current Yarn releases use .yarnrc.yml with npmScopes and npmAuthToken instead; see Yarn's registry settings. For npm's exact file and token rules, see the npm documentation. Learn how private registries handle access and review the security model.