npm E401 means your registry credentials are wrong or expired. Fix by re-running npm login or updating the auth token in .npmrc.
Fixes E401
find ~ -name '.npmrc' -type f
cat ~/.npmrcfind ~ -name '.npmrc' -type fcat ~/.npmrcnpm error code E401 npm error Incorrect or missing password.
On this page
The E401 error indicates an authentication failure when npm tries to access a private package registry. It occurs at the HTTP level when the registry server rejects your credentials, whether that's because your authentication token has expired, is malformed, is missing entirely, or the .npmrc configuration points to the wrong registry URL.
List all .npmrc files on your system:
find ~ -name '.npmrc' -type f
cat ~/.npmrcIf you have multiple .npmrc files, npm uses them in order: project-level → user-level → global.
Verify the syntax matches your registry type:
registry=https://your-registry-url.com/npm/
//your-registry-url.com/npm/:_authToken=your-token-here
//your-registry-url.com/npm/:always-auth=trueFor scoped packages:
@org:registry=https://your-registry-url.com/npm/
//your-registry-url.com/npm/:_authToken=your-token-hereYour token may have expired. For GitHub Packages:
npm login --scope=@owner --registry=https://npm.pkg.github.comFor Azure Artifacts:
npx vsts-npm-auth -config .npmrcIf the protocol doesn't match your package-lock.json:
rm package-lock.json
npm cache clean --force
npm installVerify your setup works:
npm whoami --registry=https://your-registry.comIf successful, you'll see your username.
npm v9+ changed to web-based authentication by default. When you configure @scope:registry=..., npm only routes @scope/* packages to that registry. Unscoped packages still go to the default registry. Never commit plaintext tokens to version control—use environment variables in CI/CD.