How to fix npm ERR! code EAUTHTOKEN npm ERR! Authentication token is invalid or expired in npm

npmINTERMEDIATEHIGHUpdated Dec 5, 2025· 139 views

The EAUTHTOKEN error occurs when npm cannot authenticate using an invalid, expired, or incorrectly configured authentication token in your .npmrc file or environment. This guide covers regenerating tokens, updating credentials, and proper configuration for npm registries.

Quick fix

Fixes EAUTHTOKEN

npm whoami
  1. Verify you are logged in to npm
  2. Delete .npmrc and re-authenticate with npm login
  3. For private registries: generate a new personal access token
  4. Clear npm cache and reinstall dependencies
npm — error
npm whoami
npm ERR! code EAUTHTOKEN
npm ERR! Authentication token is invalid or expired

What this error means

This error means npm is unable to authenticate your identity when trying to access the npm registry (or a private registry). The authentication token stored in your .npmrc file or environment variables has either expired, been revoked, or is incorrectly formatted. npm uses tokens to verify that you have permission to install packages, especially from private registries or scoped packages. The token might be invalid if your npm account password was recently changed, your organization revoked access, or the token configuration is syntactically incorrect. This commonly happens in CI/CD pipelines, when setting up private registries, or after security updates when npm deprecates older token types.

Typical symptoms

  • npm install, npm publish, or npm ci fails with EAUTHTOKEN error during authentication step
  • Commands work on one machine but fail on another (inconsistent token configuration)
  • npm whoami returns 'not logged in' or 'unauthenticated' status
  • Private packages fail to install even though you have access to them
  • Token was recently generated but npm still rejects it as invalid

Common causes

  1. Authentication token has expired due to npm's session expiration or automatic revocation of legacy tokens
  2. Token was revoked or invalidated after npm account password change or security event
  3. Token is in legacy/classic format and has been removed from npm
  4. Token is incorrectly formatted or malformed in .npmrc file (missing protocol, wrong variable syntax)
  5. Token is stored in git-checked .npmrc file instead of environment variables, causing local vs. remote mismatches
  6. Stale npm cache or corrupted package-lock.json file preventing authentication retry

How to fix "npm ERR! code EAUTHTOKEN npm ERR! Authentication token is invalid or expired"

1Verify you are logged in to npm

First check if npm recognizes your current authentication status.

bash
npm whoami

If this command returns 'not logged in' or throws an error, you need to authenticate. If it returns a username, your local token exists but may be expired or invalid for the registry you're trying to access.

2Delete .npmrc and re-authenticate with npm login

Remove your current .npmrc file and re-authenticate. This generates a fresh token.

On macOS/Linux:

bash
rm ~/.npmrc
npm login

On Windows:

bash
del %USERPROFILE%\.npmrc
npm login

You'll be prompted for username, password, and email. npm will automatically create a new .npmrc with a valid token. This is the most straightforward fix for local development.

3For private registries: generate a new personal access token

If you use a private registry (GitHub Packages, GitLab, Azure Artifacts, etc.), you need to generate a new token from that service, not npm.

GitHub Packages:
1. Go to https://github.com/settings/tokens
2. Click "Generate new token (classic)" or "Generate new token (fine-grained)"
3. Select scopes: read:packages and write:packages
4. Copy the token and update your .npmrc with the new token

GitLab:
1. Go to https://gitlab.com/-/user_settings/personal_access_tokens
2. Create a new token with read_api and write_repository scopes
3. Update your .npmrc with the new token

Generic .npmrc Update:

bash
npm config set //registry.example.com/:_authToken "YOUR_NEW_TOKEN_HERE"
4Clear npm cache and reinstall dependencies

Stale cache or corrupted package-lock.json can cause persistent authentication issues. Do a clean reinstall.

On macOS/Linux:

bash
rm -rf node_modules
rm -f package-lock.json
npm cache clean --force
npm install

On Windows:

bash
rd /s /q "node_modules"
del package-lock.json
npm cache clean --force
npm install

This forces npm to re-authenticate and fetch fresh package data from the registry.

5For CI/CD: use environment variables instead of .npmrc in git

Never commit tokens to git. Instead, use environment variables in CI/CD pipelines.

Create a .npmrc at the project root (do not commit this file):

bash
//registry.npmjs.org/:_authToken=${NPM_TOKEN}
@yourscope:registry=https://registry.example.com/
//registry.example.com/:_authToken=${YOUR_PRIVATE_TOKEN}

Then in your CI/CD pipeline, set the environment variable:

GitHub Actions:

yaml
steps:
  - name: Install dependencies
    run: npm install
    env:
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
      YOUR_PRIVATE_TOKEN: ${{ secrets.PRIVATE_REGISTRY_TOKEN }}

GitLab CI:

yaml
install:
  script:
    - npm install
  variables:
    NPM_TOKEN: $NPM_TOKEN

Advanced notes

For CI/CD environments, consider using OIDC (OpenID Connect) / Trusted Publishing instead of static tokens. GitHub Actions, GitLab CI, and other platforms now support keyless authentication that automatically exchanges a short-lived OIDC token for registry access—eliminating the need to rotate long-lived secrets entirely. See npm documentation on 'Trusted Publishing'.

If you use a private registry behind a corporate proxy or firewall, your token might be valid but the registry unreachable. Test connectivity with npm ping --registry=https://your.registry.com/.

For monorepos or projects with multiple registries, use scoped configuration. Each registry needs its own token entry in .npmrc, scoped by the registry URL:

bash
//npm.fontawesome.com/:_authToken=token1
//registry.custom.com/:_authToken=token2

Frequently asked questions

What does "EAUTHTOKEN" mean?
This error means npm is unable to authenticate your identity when trying to access the npm registry (or a private registry). npmrc file or environment variables has either expired, been revoked, or is incorrectly formatted. npm uses tokens to verify that you have permission to install packages, especially from private registries or scoped packages.
How do I fix "EAUTHTOKEN"?
The EAUTHTOKEN error occurs when npm cannot authenticate using an invalid, expired, or incorrectly configured authentication token in your .npmrc file or environment. This guide covers regenerating tokens, updating credentials, and proper configuration for npm registries.
What causes "EAUTHTOKEN"?
Authentication token has expired due to npm's session expiration or automatic revocation of legacy tokens Token was revoked or invalidated after npm account password change or security event Token is in legacy/classic format and has been removed from npm
Is the "EAUTHTOKEN" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading