The npm E401 error occurs when npm cannot authenticate your credentials or access token for the npm registry. This typically happens due to expired tokens, incorrect passwords, stale credentials in .npmrc files, or authentication configuration issues.
Fixes E401
npm whoaminpm whoaminpm ERR! code E401npm ERR! Incorrect or missing password
On this page
The E401 Unauthorized error means npm failed to authenticate your request to the registry when installing packages. This commonly occurs when your stored access token has expired, you've recently changed your npm password, your .npmrc file contains malformed credentials, or you're trying to access a private package without valid authentication.
First, verify your current npm login status:
npm whoamiIf this returns 'unauthenticated' or an error, you need to log in.
Clear your current npm session and re-authenticate:
npm logout
npm loginWhen prompted, enter your npm username, password, and email address.
Remove cached dependencies:
rm -rf node_modules package-lock.json
npm cache clean --force
npm installCheck if your .npmrc file contains valid configuration:
cat ~/.npmrcFor public npm packages, your .npmrc should only contain:
registry=https://registry.npmjs.org/If using public npm packages only, reset your registry:
npm config set registry https://registry.npmjs.org/Then retry npm install.
If nothing else works, completely remove your .npmrc:
rm ~/.npmrc
npm login
npm installThe E401 error is intentionally generic for security—npm doesn't reveal whether authentication failed due to wrong password, expired token, or missing credentials. For CI/CD pipelines, use CI-specific token management: GitHub Actions use secrets, GitLab CI uses masked variables. Never commit .npmrc files with credentials to version control.