Publish a private npm package

Set the package name and registry

Create a shared scope or private registry first. In your package's package.json, use a name you own, such as @acme/sdk, and a new version. Published version contents are immutable, and an unpublished version number cannot be reused.

For a shared scope, put this in the publisher's project .npmrc. Supply the secret as an environment variable rather than committing it:

@acme:registry=https://registry.privatenpm.com/
//registry.privatenpm.com/:_authToken=${PUBLISHER_KEY}

Issue a publisher key and publish

1. On the registry card, choose Manage keys → New publisher key. Issue it for your user or CI pipeline. Select the package:publish action and limit the key to the package or scope your release needs. Save the reveal-once prt_… secret.
2. Set PUBLISHER_KEY in your shell or CI secret store, then run npm publish from the package directory.
3. Open Registry → Packages to confirm the version and dist-tag. For a clean install test, issue a separate download key and use it with the install configuration.

If npm rejects the publish, check the package name, registry host, publisher key audience and actions, and whether your organization has a card on file during its trial. A download key is read-only and cannot publish.