How to fix npm ERR! code E401 npm ERR! 401 Unauthorized - Token has expired in npm

For local development, the simplest fix is to re-authenticate with npm:

npm login

This creates a new two-hour session token. You'll be prompted for:
- Username
- Password
- Email address
- Two-factor authentication code (if enabled)

Note: Session tokens expire after 2 hours for security, so you'll need to re-authenticate periodically.

For automated workflows (GitHub Actions, GitLab CI, Jenkins, etc.), create a long-lived granular access token:

Option 1: Using the CLI

npm token create --read-only  # For installing packages
npm token create              # For publishing (max 90 days)

Option 2: Using the npm website
1. Go to https://www.npmjs.com/settings/[username]/tokens
2. Click "Generate New Token"
3. Choose "Granular Access Token"
4. Set expiration (max 90 days for write tokens)
5. Configure package access permissions
6. Copy the token immediately (shown only once)

Update your .npmrc or environment variables:

# .npmrc file
//registry.npmjs.org/:_authToken=${NPM_TOKEN}

Store the token in your CI/CD secrets as NPM_TOKEN.

Invalid or corrupted .npmrc files cause authentication failures. Check and fix your configuration:

Locate your .npmrc:

# User-level (most common)
cat ~/.npmrc

# Project-level
cat .npmrc

Remove old/invalid tokens:

# Delete the file to start fresh
rm ~/.npmrc

# Or edit to remove expired token lines
nano ~/.npmrc

For scoped packages, ensure registry is properly configured:

@yourscope:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=TOKEN_HERE

After fixing .npmrc, clear cache and reinstall:

npm cache clean --force
rm -rf node_modules package-lock.json
npm install

Eliminate token expiration issues entirely by using OpenID Connect (OIDC) authentication:

GitHub Actions example:

- name: Setup Node.js
  uses: actions/setup-node@v4
  with:
    node-version: '20'
    registry-url: 'https://registry.npmjs.org'

- name: Publish package
  run: npm publish
  env:
    NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

Benefits:
- No long-lived tokens to manage or rotate
- Tokens are generated automatically per job
- Scoped to specific packages and operations
- Automatically expire after job completes

Setup trusted publishing:
1. Go to https://www.npmjs.com/package/[package-name]/access
2. Enable "Trusted publishing"
3. Configure your CI provider (GitHub, GitLab, etc.)
4. Remove hard-coded tokens from your workflows

If using third-party private registries, follow their renewal process:

GitHub Packages:

# Use a personal access token with package permissions
echo "//npm.pkg.github.com/:_authToken=YOUR_PAT" >> ~/.npmrc

Generate new PAT at: https://github.com/settings/tokens

Azure DevOps:
1. Navigate to User Settings > Personal Access Tokens
2. Check expiration date of existing tokens
3. Create new token with "Packaging (Read & Write)" scope
4. Update .npmrc:

registry=https://pkgs.dev.azure.com/ORG/_packaging/FEED/npm/registry/
always-auth=true
//pkgs.dev.azure.com/ORG/_packaging/FEED/npm/registry/:username=anything
//pkgs.dev.azure.com/ORG/_packaging/FEED/npm/registry/:_password=[BASE64_ENCODED_PAT]
//pkgs.dev.azure.com/ORG/_packaging/FEED/npm/registry/:email=anything

JFrog Artifactory:

# Re-authenticate with JFrog CLI
jf rt login