npm "E401 ... no auth token" for a private registry in CI

By Kaveh Alemi·Latchkey

npm returned E401 with "no auth token" because .npmrc has no //<host>/:_authToken= line for the registry it is querying. The registry expects auth and npm sent none.

What this error means

npm install stops with "npm error code E401" and "npm error Unable to authenticate, your authentication token seems to be invalid" or "npm error need auth ... no auth token" for the private registry host.

npm error code E401
npm error Unable to authenticate, your authentication token seems to be invalid.
npm error need auth This command requires you to be logged in to https://registry.internal.example.com/
npm error need auth You need to authorize this machine using `npm adduser`

Common causes

No _authToken line for the registry host

The .npmrc sets registry= but omits the matching //host/:_authToken= line, so npm has no credential to send.

The token env var is not expanded

A ${NPM_TOKEN} placeholder stays literal when the secret is not exported to the step, leaving an effectively empty token.

How to fix it

Add the host _authToken line

1. Add a //<host>/:_authToken=${NPM_TOKEN} line matching the registry host.
2. Export NPM_TOKEN from a CI secret in the step env.
3. Confirm the host in the token line matches the registry URL exactly.

registry=https://registry.internal.example.com/
//registry.internal.example.com/:_authToken=${NPM_TOKEN}

Confirm expansion in the runner

npm expands ${VAR} in .npmrc from the environment; make sure the secret is present when npm runs.

env:
  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

How to prevent it

• Pair every private registry= with a matching _authToken line.
• Inject the token from a secret and export it to the npm step.
• Match the token host to the registry host character for character.

Frequently asked questions

Related guides

References

• Node.js documentation
• npm CLI documentation
• GitHub Actions documentation