How to fix npm notice access token expired or revoked. Please try logging in again. in npm

For local work, the quickest fix is to log in again, which writes a fresh token into your user-level ~/.npmrc:

npm login

You'll be prompted for your username, password, email, and a one-time password if two-factor authentication is enabled (modern npm typically opens a browser to complete login). After it finishes, verify you're authenticated:

npm whoami

If npm whoami prints your username, the new token is in place and installs/publishes should work again.

For automated workflows that still use a token (GitHub Actions, GitLab CI, Jenkins, etc.), create a new granular access token and store it as a CI secret rather than committing it.

Using the npm website (recommended, gives full control over scope and expiration):
1. Go to your account's Access Tokens page: https://www.npmjs.com/settings/<your-username>/tokens
2. Click Generate New Token and choose Granular Access Token.
3. Set an expiration date (you can choose up to 90 days for the longest-lived option).
4. Restrict the token to only the packages/scopes it needs, and grant the minimum permission (read-only for installs, read-and-write only for publishing).
5. Copy the token immediately — it is shown only once.

Store the value in your CI provider's secret store as NPM_TOKEN, then reference it in .npmrc via an environment variable so the secret is never written to disk in plaintext:

# .npmrc (committed; the token itself is NOT committed)
//registry.npmjs.org/:_authToken=${NPM_TOKEN}

Because granular tokens expire, set a reminder to rotate this before its expiration date.

A malformed or stale token line in .npmrc produces the same E401. Check the relevant files:

# User-level (most common)
cat ~/.npmrc

# Project-level (overrides user-level for this project)
cat .npmrc

Look for an _authToken line and confirm the value is intact (not truncated) and points at the registry you actually use. Remove or replace any obviously stale token line. Editing the file is safer than deleting it, since ~/.npmrc often holds other settings you want to keep:

nano ~/.npmrc   # remove or update the expired _authToken line

For scoped packages, make sure both the registry mapping and its auth line are present:

@yourscope:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}

A simple installed-state mismatch usually does not require wiping caches, but if installs still misbehave after fixing auth, reinstalling dependencies is a safe reset:

rm -rf node_modules
npm ci   # or: npm install

For publishing from CI, trusted publishing lets the registry verify your workflow's OIDC identity, so there is no long-lived token to store or rotate. The key difference from token auth: you grant the job id-token: write permission and you do not set NODE_AUTH_TOKEN or an NPM_TOKEN secret — npm exchanges the OIDC identity for short-lived credentials automatically.

First, enable trusted publishing for the package:
1. Open the package's access settings: https://www.npmjs.com/package/<package-name>/access
2. Configure a trusted publisher for your CI provider (e.g. GitHub Actions), specifying the repository and workflow filename.

GitHub Actions example (no NPM_TOKEN):

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      id-token: write   # required for OIDC trusted publishing
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          registry-url: 'https://registry.npmjs.org'
      - run: npm ci
      - run: npm publish
        # No NODE_AUTH_TOKEN / NPM_TOKEN needed — npm uses the OIDC identity

Use a recent npm CLI (trusted publishing requires up-to-date tooling; npm install -g npm@latest). Once trusted publishing works, delete any NPM_TOKEN secret from the workflow.

If the failing registry is not npmjs.org, renew the credential through that provider.

GitHub Packages — use a personal access token (or GITHUB_TOKEN in Actions) with the read:packages / write:packages scope, referenced via an environment variable:

//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}

Generate or rotate a PAT at https://github.com/settings/tokens.

Azure DevOps Artifacts — create a new Personal Access Token with the Packaging (Read & Write) scope, then update .npmrc. The _password value must be the base64-encoded PAT:

registry=https://pkgs.dev.azure.com/ORG/_packaging/FEED/npm/registry/
always-auth=true
//pkgs.dev.azure.com/ORG/_packaging/FEED/npm/registry/:username=anything
//pkgs.dev.azure.com/ORG/_packaging/FEED/npm/registry/:_password=[BASE64_ENCODED_PAT]
//pkgs.dev.azure.com/ORG/_packaging/FEED/npm/registry/:email=anything

JFrog Artifactory — re-authenticate to regenerate the npm auth config:

jf rt login