Dependabot "couldn't authenticate" with a private registry in CI

By Daniel Zoghalchali·Latchkey

Dependabot reached your private registry but was rejected because it had no valid credentials. The registries block in dependabot.yml is either absent or references a secret that is not stored under the repository's Dependabot secrets (which are separate from Actions secrets).

What this error means

The Dependabot logs on the "Dependabot" tab show "Dependabot couldn't authenticate with <registry>" or a 401 against a private feed, and no update PRs are opened for packages hosted there.

Dependabot couldn't authenticate with https://pkgs.internal.example.com/npm/
Please check that the registry credentials in your dependabot.yml are correct.

Common causes

No registries block in dependabot.yml

The updates entry points at a private package but there is no matching registries: definition, so Dependabot sends an anonymous request and is rejected.

The token is stored as an Actions secret, not a Dependabot secret

Dependabot reads secrets from Settings > Secrets and variables > Dependabot, a separate store from Actions secrets. A token added only under Actions is invisible to ${{secrets.X}} references in dependabot.yml.

How to fix it

Declare the registry and reference a Dependabot secret

1. Add the token under Settings > Secrets and variables > Dependabot (not Actions).
2. Add a registries: block and reference that secret by name.
3. Attach the registry to the matching updates entry.

version: 2
registries:
  npm-internal:
    type: npm-registry
    url: https://pkgs.internal.example.com/npm/
    token: ${{secrets.NPM_INTERNAL_TOKEN}}
updates:
  - package-ecosystem: "npm"
    directory: "/"
    registries:
      - npm-internal
    schedule:
      interval: "weekly"

Verify the secret is set in the Dependabot store

A blank reference resolves to an empty token. Confirm the secret exists under the Dependabot secrets page, then re-run "Check for updates" from the Dependabot tab.

How to prevent it

• Store registry tokens under Dependabot secrets, separate from Actions secrets.
• Keep a registries block for every private feed referenced by an update.
• Rotate registry tokens on a schedule and update the Dependabot secret in one place.

Frequently asked questions

Related guides

References

• GitHub Actions documentation