How to fix npm error code E401 npm error Incorrect or missing password. in npm

npmINTERMEDIATEHIGHUpdated May 28, 2026· 174 views

npm E401 means your registry credentials are wrong or expired. Fix by re-running npm login or updating the auth token in .npmrc.

Quick fix

Fixes E401

find ~ -name '.npmrc' -type f
cat ~/.npmrc
  1. Verify the correct registry URL and locate your .npmrc file
  2. Check and fix .npmrc configuration syntax
  3. Regenerate and update your authentication token
  4. Delete package-lock.json and clear npm cache
npm — error
find ~ -name '.npmrc' -type f
cat ~/.npmrc
npm error code E401 npm error Incorrect or missing password.

What this error means

The E401 error indicates an authentication failure when npm tries to access a private package registry. It occurs at the HTTP level when the registry server rejects your credentials, whether that's because your authentication token has expired, is malformed, is missing entirely, or the .npmrc configuration points to the wrong registry URL.

Typical symptoms

  • npm install fails with E401 error and halts dependency installation
  • Package manager can access public npm registry but fails on scoped private packages
  • npm login command succeeds, but subsequent install commands still fail
  • CI/CD pipelines fail during npm install even with authentication tokens configured
  • Error message includes 'Incorrect or missing password' or 'Bearer authorization'

Common causes

  1. Authentication token in .npmrc has expired or been revoked
  2. Incorrect .npmrc syntax—missing colon, wrong registry URL format, or protocol mismatch
  3. Token not base64 encoded when required by the registry (especially Azure Artifacts)
  4. Missing :_authToken or :always-auth configuration in .npmrc
  5. Wrong registry URL in .npmrc—publishing/installing from public registry instead of private
  6. package-lock.json cached with incorrect protocol—npm v7+ requires exact protocol match

How to fix "npm error code E401 npm error Incorrect or missing password."

1Verify the correct registry URL and locate your .npmrc file

List all .npmrc files on your system:

bash
find ~ -name '.npmrc' -type f
cat ~/.npmrc

If you have multiple .npmrc files, npm uses them in order: project-level → user-level → global.

2Check and fix .npmrc configuration syntax

Verify the syntax matches your registry type:

bash
registry=https://your-registry-url.com/npm/
//your-registry-url.com/npm/:_authToken=your-token-here
//your-registry-url.com/npm/:always-auth=true

For scoped packages:

bash
@org:registry=https://your-registry-url.com/npm/
//your-registry-url.com/npm/:_authToken=your-token-here
3Regenerate and update your authentication token

Your token may have expired. For GitHub Packages:

bash
npm login --scope=@owner --registry=https://npm.pkg.github.com

For Azure Artifacts:

bash
npx vsts-npm-auth -config .npmrc
4Delete package-lock.json and clear npm cache

If the protocol doesn't match your package-lock.json:

bash
rm package-lock.json
npm cache clean --force
npm install
5Test authentication with npm whoami

Verify your setup works:

bash
npm whoami --registry=https://your-registry.com

If successful, you'll see your username.

Advanced notes

npm v9+ changed to web-based authentication by default. When you configure @scope:registry=..., npm only routes @scope/* packages to that registry. Unscoped packages still go to the default registry. Never commit plaintext tokens to version control—use environment variables in CI/CD.

Frequently asked questions

What does "E401" mean?
The E401 error indicates an authentication failure when npm tries to access a private package registry. npmrc configuration points to the wrong registry URL.
How do I fix "E401"?
npm E401 means your registry credentials are wrong or expired. Fix by re-running npm login or updating the auth token in .npmrc.
What causes "E401"?
Authentication token in .npmrc has expired or been revoked Incorrect .npmrc syntax—missing colon, wrong registry URL format, or protocol mismatch Token not base64 encoded when required by the registry (especially Azure Artifacts)
Is the "E401" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading