npm Package Registry Authentication

Configure the npm client to authenticate with pckgs.io so it can install and publish private packages in your organization’s registry.

Prerequisites

Membership in an organization. See Create an Organization.
Access token. See Create an Access Token.
Node.js and npm installed.

Step 1: Generate an Access Token

Create an access token at pckgs.io/access-tokens/create. Grant it read access to install packages, and write access to publish them, scoped to the organization whose registry you want to use. See Create an Access Token for full instructions.

Step 2: Configure `.npmrc`

npm reads credentials from an .npmrc file either in your project root, or in your home directory (~/.npmrc on macOS/Linux, %USERPROFILE%\.npmrc on Windows).

Because pckgs.io packages are always scoped, point the scope at your registry and attach the token to the same host path:

@<YOUR_SCOPE>:registry=https://npm.pckgs.io/<YOUR_ORG_SLUG>/
//npm.pckgs.io/<YOUR_ORG_SLUG>/:_authToken=<YOUR_ACCESS_TOKEN>

Replace <YOUR_SCOPE> with the package scope (for example acme for @acme/utils), <YOUR_ORG_SLUG> with your organization’s slug, and <YOUR_ACCESS_TOKEN> with the token you created.

Only packages under @<YOUR_SCOPE> are resolved from pckgs.io, everything else keeps coming from your default registry.

Multiple Scopes

Map each scope on its own line. A single _authToken line covers them all as long as they share the same registry URL:

@myscope:registry=https://npm.pckgs.io/myorg/
@myscope-labs:registry=https://npm.pckgs.io/myorg/
//npm.pckgs.io/myorg/:_authToken=<YOUR_ACCESS_TOKEN>

Step 3: Verify

Confirm the client is authenticated as you:

npm whoami --registry=https://npm.pckgs.io/<YOUR_ORG_SLUG>

It prints the email address of the account the token belongs to.

Alternative: `npm login`

Instead of writing .npmrc by hand you can let npm do it:

npm login --registry=https://npm.pckgs.io/<YOUR_ORG_SLUG> --scope=@<YOUR_SCOPE> --auth-type=legacy

When prompted, you can write anything as username and for password you should write access token which you generated from the website. pckgs.io has no separate npm password the token is the credential.

Currently only —auth-type=legacy authentication is supported.

CI/CD

Never commit a token. Keep the scope mapping in the repository’s .npmrc and inject the token from a secret at build time:

@<YOUR_SCOPE>:registry=https://npm.pckgs.io/<YOUR_ORG_SLUG>/
//npm.pckgs.io/<YOUR_ORG_SLUG>/:_authToken=${PCKGS_TOKEN}

npm expands ${PCKGS_TOKEN} from the environment, so the file itself stays free of secrets.

Need help? Contact us here or at [email protected].