How to fix npm ERR! code E401 npm ERR! 401 Unauthorized in npm

npmBEGINNERMEDIUMUpdated Jul 8, 2026· 290 views

Fix npm E401 401 Unauthorized errors when installing or publishing. Caused by expired tokens or bad .npmrc auth. Step-by-step fix here.

Quick fix

Fixes E401

npm whoami
  1. Verify your authentication status
  2. Log out and log back in
  3. Check and clean your .npmrc file
  4. Delete package-lock.json and retry
npm — error
npm whoami
npm ERR! code E401 npm ERR! 401 Unauthorized

What this error means

The E401 Unauthorized error in npm indicates that the registry rejected your authentication credentials. This happens when npm sends a request to download or publish a package, but the authentication token is missing, expired, or invalid. When you run `npm install` or `npm publish`, npm reads authentication credentials from your `.npmrc` file (located in your home directory or project folder) and includes them in requests to the registry. If these credentials are wrong or have expired, the registry returns a 401 Unauthorized response. This error commonly appears after password resets, when access tokens expire, when switching between registries (public npm vs private registries like Azure Artifacts, GitHub Packages, or Verdaccio), or when CI/CD pipelines have stale credentials.

Typical symptoms

  • npm install fails with E401 error for private packages
  • npm publish commands are rejected with 401 Unauthorized
  • Error appears after recently changing npm password or regenerating tokens
  • CI/CD pipelines fail at npm install step after working previously
  • npm commands work on one machine but fail on another

Common causes

  1. Expired or revoked npm access token in .npmrc (most common)
  2. Password was recently reset but .npmrc still has old credentials
  3. Missing authentication for a private npm registry
  4. Stale _authToken entry in user or project .npmrc file
  5. NPM_TOKEN environment variable contains invalid or expired token
  6. Protocol mismatch in package-lock.json after upgrading npm version
  7. Azure DevOps or GitHub Packages personal access token has expired

How to fix "npm ERR! code E401 npm ERR! 401 Unauthorized"

1Verify your authentication status

First, check if you're currently logged in to npm:

bash
npm whoami

If this returns an error like ENEEDAUTH or E401, you're not authenticated. If it returns a username, your credentials exist but may be expired or invalid for the specific registry.

Also check which registry npm is configured to use:

bash
npm config get registry

The default public registry is https://registry.npmjs.org/.

2Log out and log back in

Clear your current authentication and log in fresh:

bash
npm logout
npm login

Follow the prompts to enter your npm username, password, and email. For accounts with 2FA enabled, you'll also need to enter a one-time password.

After logging in, verify it worked:

bash
npm whoami
3Check and clean your .npmrc file

The .npmrc file stores your authentication tokens. Check all locations for stale tokens:

On macOS/Linux:

bash
cat ~/.npmrc

On Windows:

powershell
type %USERPROFILE%\.npmrc

Look for lines containing _authToken or _auth. If you see old tokens, remove them:

bash
# Remove the stale token line, or delete the file entirely:
rm ~/.npmrc

Then run npm login again to regenerate valid credentials.

Also check for a project-level .npmrc that might have stale tokens:

bash
cat .npmrc  # In your project directory
4Delete package-lock.json and retry

If you recently upgraded npm or switched registries, your package-lock.json may contain resolved URLs that no longer match your .npmrc configuration:

bash
rm package-lock.json
npm install

This forces npm to resolve all packages fresh with your current registry and credentials.

Note: If you use a lockfile for reproducible builds, commit the new package-lock.json after it's regenerated.

5Reset the npm registry to default

If your registry configuration is incorrect, reset it to the public npm registry:

bash
npm config set registry https://registry.npmjs.org/

Then try your command again. If you need a private registry, ensure you configure both the registry URL and authentication token correctly.

6Clear npm cache

In some cases, cached authentication data can cause issues:

bash
npm cache clean --force

Then retry your npm command.

7Generate a new access token (for CI/CD)

For automated environments, use access tokens instead of logging in interactively.

Generate a token on npmjs.com:
1. Go to https://www.npmjs.com/settings/~/tokens
2. Click "Generate New Token"
3. Choose "Granular Access Token" (recommended) or "Classic Token"
4. Set appropriate permissions and expiration

Add the token to your .npmrc:

bash
//registry.npmjs.org/:_authToken=YOUR_TOKEN_HERE

Or use an environment variable (recommended for CI/CD):

bash
//registry.npmjs.org/:_authToken=${NPM_TOKEN}

Then set NPM_TOKEN as a secret in your CI/CD platform.

Advanced notes

### Private Registry Authentication

For private registries (Azure Artifacts, GitHub Packages, JFrog Artifactory, Verdaccio), each has its own authentication method:

Azure Artifacts:

bash
# Install the credential helper
npm install -g vsts-npm-auth

# Authenticate (creates/updates .npmrc)
vsts-npm-auth -config .npmrc

# Force re-authentication if tokens expired
vsts-npm-auth -config .npmrc -F

GitHub Packages:

bash
# In .npmrc
//npm.pkg.github.com/:_authToken=YOUR_GITHUB_PAT
@your-org:registry=https://npm.pkg.github.com

### Token Expiration

- Legacy npm tokens never expired, but they were removed on November 5, 2025
- Granular access tokens can have custom expiration (1 day to 1 year)
- Azure DevOps PATs expire by default (max 1 year)
- Set calendar reminders to rotate tokens before expiration

### Scoped Packages

If the error only occurs for scoped packages (@company/package-name), you may need registry configuration specific to that scope:

bash
# Route @company packages to private registry
npm config set @company:registry https://npm.company.com/

# Set auth for that registry
//npm.company.com/:_authToken=TOKEN

### Debugging Authentication Issues

Enable verbose logging to see exactly where authentication fails:

bash
npm install --loglevel verbose

Or check the npm debug log:

bash
cat ~/.npm/_logs/*-debug.log

### Two-Factor Authentication

If your npm account has 2FA enabled and you're publishing, you'll need to provide a one-time password:

bash
npm publish --otp=123456

For automation, use an access token with appropriate permissions - 2FA is not required when using tokens.

Frequently asked questions

What does "E401" mean?
The E401 Unauthorized error in npm indicates that the registry rejected your authentication credentials. This happens when npm sends a request to download or publish a package, but the authentication token is missing, expired, or invalid. npmrc file (located in your home directory or project folder) and includes them in requests to the registry.
How do I fix "E401"?
Fix npm E401 401 Unauthorized errors when installing or publishing. Caused by expired tokens or bad .npmrc auth. Step-by-step fix here.
What causes "E401"?
Expired or revoked npm access token in .npmrc (most common) Password was recently reset but .npmrc still has old credentials Missing authentication for a private npm registry
Is the "E401" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading