How to fix npm ERR! 407 Proxy Authentication Required in npm

Point npm at your proxy and include credentials in the URL:

npm config set proxy http://username:password@proxy.company.com:8080
npm config set https-proxy http://username:password@proxy.company.com:8080

URL-encode special characters in the password (@ becomes %40, etc. — see the dedicated step below).

Security warning: npm config set proxy http://user:password@... writes your password in cleartext to ~/.npmrc. That file is routinely committed to dotfiles repos, synced to cloud backups, or copied into Docker images and CI logs — any of which leaks your corporate credentials. Treat this with care:

- Never commit `.npmrc`. Add it to .gitignore (both ~/.npmrc patterns and any project-local .npmrc).
- For automated environments, prefer pulling the value from a secret store (Vault, AWS Secrets Manager, your CI's secret variables) at runtime instead of persisting it on disk.
- Rotate the password if you suspect it was ever committed or logged.

Instead of writing credentials to ~/.npmrc, npm also reads standard proxy environment variables:

export HTTP_PROXY=http://username:password@proxy.company.com:8080
export HTTPS_PROXY=http://username:password@proxy.company.com:8080
export NO_PROXY=localhost,127.0.0.1,.company.com

This keeps the password out of ~/.npmrc, but it is not inherently more secure: the password is still inline in the URL, so it lands in your shell history (~/.bash_history, ~/.zsh_history) and is visible in the process environment to anything that can read /proc or run ps/env.

To avoid the shell-history leak, source the value from a secret store rather than typing it literally, e.g.:

# password fetched from a secret manager, never typed inline
export PROXY_PW="$(read-from-secret-store proxy-password)"
export HTTPS_PROXY="http://username:${PROXY_PW}@proxy.company.com:8080"

Or add a leading space to the export command if your shell is configured with HISTCONTROL=ignorespace. The goal is the same as Step 1: keep the cleartext password out of files and history.

If your password contains characters that are meaningful in a URL, you must URL-encode them or npm will misparse the proxy URL:

# If password is "P@ss#word!"
# @ = %40, # = %23, ! = %21
npm config set proxy http://user:P%40ss%23word%21@proxy:8080

Common encodings: @ = %40, # = %23, $ = %24, ! = %21, & = %26, : = %3A, / = %2F, % = %25.

npm cannot perform NTLM or Kerberos authentication itself. Run a local helper proxy that handles Windows auth and forwards to npm over plain HTTP.

cntlm is the classic option:

# Install cntlm
sudo apt install cntlm  # Linux
brew install cntlm      # macOS

Do not put your plaintext domain password in `/etc/cntlm.conf`. Instead, generate a hashed PassNTLMv2 value so the cleartext password never sits in the config file:

# Generates PassLM/PassNT/PassNTLMv2 hashes; you type the password once, interactively
cntlm -H -u your-domain-username -d YOURDOMAIN

Copy only the PassNTLMv2 line it prints into /etc/cntlm.conf (alongside Username, Domain, and the upstream Proxy entries), and remove any plaintext Password line. Then start cntlm and point npm at it:

sudo cntlm -c /etc/cntlm.conf
npm config set proxy http://localhost:3128
npm config set https-proxy http://localhost:3128

px is a good modern alternative (especially on Windows) and can use the logged-in user's Kerberos/NTLM credentials without storing any password.

On corporate networks the proxy often performs TLS interception (MITM), re-signing HTTPS with an internal CA. Once the 407 is resolved, the very next failure you may hit is a certificate error such as:

npm ERR! code SELF_SIGNED_CERT_IN_CHAIN
npm ERR! code UNABLE_TO_GET_ISSUER_CERT_LOCALLY

This is not an npm bug — npm just doesn't trust your company's internal CA yet. Do not "fix" it with npm config set strict-ssl false; that disables certificate verification entirely and exposes you to real man-in-the-middle attacks.

Instead, obtain your corporate root CA certificate (PEM format) from your IT team and point npm at it:

npm config set cafile /path/to/corp-ca.pem

If you have multiple CAs, concatenate them into one PEM file. You can also set NODE_EXTRA_CA_CERTS=/path/to/corp-ca.pem so Node itself (and other Node tooling) trusts the CA.

Check your current npm proxy configuration:

npm config get proxy
npm config get https-proxy
npm config list

Ensure the values match your corporate proxy host and port. Watch for stale or duplicate settings left over from a previous network.

Confirm the proxy itself works independently of npm:

# Test with curl
curl -x http://user:pass@proxy:8080 https://registry.npmjs.org

# Check npm verbose output
npm install --verbose 2>&1 | grep -i proxy

If curl succeeds but npm fails, the issue is in npm's config rather than the proxy or your credentials.