How to fix npm error code E403 npm error 403 Forbidden - PUT https://registry.npmjs.org/<package> in npm

Read the full error. The HTTP method tells you which path to follow:

- GET ... 403 during npm install -> usually registry config, proxy/VPN, or private-registry auth.
- PUT ... 403 during npm publish -> usually authentication, token scope, package-name ownership, or 2FA.

npm install --loglevel=verbose
# or
npm publish --loglevel=verbose

Note the exact URL and method shown so you apply the right fix below.

Most publish-time 403s are stale or missing credentials. Check who you are, then log in again:

# Check if you're logged in
npm whoami

# If this errors or shows the wrong user, log in again
npm login

# Verify
npm whoami

npm whoami should print your npm username without errors. If your account has 2FA enabled for publishing, supply a one-time password:

npm publish --otp=123456

A PUT ... 403 on publish often means the name is already taken or you don't have write access to it:

npm view <package-name>

If the package exists and you are not an owner, you cannot publish to that name. Options:

1. Use a scoped package name (recommended):

{
     "name": "@your-username/package-name"
   }

For a public scoped package, the first publish must allow public access:

npm publish --access public

2. Choose a different, unused package name.

If you publish from CI using a token, a read-only token will produce a 403 on publish:

1. Go to https://www.npmjs.com/settings/~/tokens
2. Confirm the token type. For publishing you need an Automation or Publish token, not a read-only token.
3. Create a new token with the correct permission if needed:

npm token create

4. Provide it via the NPM_TOKEN environment variable and reference it in .npmrc rather than hardcoding the secret:

//registry.npmjs.org/:_authToken=${NPM_TOKEN}

Keep tokens in CI secret storage, never commit them to the repository.

npm requires a verified email address before you can publish packages:

1. Log in to https://www.npmjs.com
2. Open your account settings
3. Confirm your email is verified; if not, click "Resend verification email"

Once verified, try publishing again.

If installs fail only on a corporate network, the registry connection is likely being blocked or intercepted.

First, test by temporarily disconnecting from the VPN and retrying. If that works, configure npm to use your corporate proxy:

npm config set proxy http://your-proxy.company.com:8080
npm config set https-proxy http://your-proxy.company.com:8080

If proxy settings were set incorrectly and are themselves the problem, remove them:

npm config delete proxy
npm config delete https-proxy

TLS-inspecting tools (ZScaler, Cisco AnyConnect, etc.) re-sign HTTPS traffic and can trigger 403s. The correct fix is to trust your company's CA certificate, not to weaken transport security:

npm config set cafile /path/to/company-ca.pem

Do not switch the registry to plain http:// — the public npm registry serves HTTPS only, so an http URL will fail, and disabling TLS validation (strict-ssl=false / NODE_TLS_REJECT_UNAUTHORIZED=0) exposes you to man-in-the-middle attacks. Use the proper CA certificate instead, or ask your network team to allowlist registry.npmjs.org.

Confirm npm is pointed at the right registry:

npm config get registry

It should show https://registry.npmjs.org/. If not, reset it:

npm config set registry https://registry.npmjs.org/

A project-level .npmrc can override your user config (for example pointing at a private registry that returns 403). Inspect it:

cat .npmrc

For a private registry (Nexus, Artifactory, Verdaccio, GitHub Packages), make sure the scope is mapped to the right host and that valid credentials exist for it, e.g.:

@myscope:registry=https://npm.mycompany.com/
//npm.mycompany.com/:_authToken=${PRIVATE_NPM_TOKEN}

A corrupted cache or a conflicting config file can produce confusing 403s. Clear the cache:

npm cache clean --force

Then review the full, layered configuration to spot stale tokens, wrong registries, or leftover proxy settings:

npm config list -l

npm merges config from command-line flags, the project .npmrc, the user ~/.npmrc, and the global /etc/npmrc, in that precedence order. If you find a bad setting, remove just that key (this is safer than wiping your whole config):

npm config delete proxy
npm config delete https-proxy

Before editing ~/.npmrc by hand, back it up so you can restore your auth tokens if needed:

cp ~/.npmrc ~/.npmrc.backup