How to fix npm ERR! code E403 npm ERR! 403 Forbidden - PUT https://registry.npmjs.org/package - You do not have permission to publish in npm

npmBEGINNERMEDIUMUpdated Dec 6, 2025· 158 views

The 403 Forbidden error when publishing occurs when the package name is taken, your email isn't verified, or you lack organization permissions. Try using a scoped package name.

Quick fix

Fixes npm ERR! code E403 npm ERR! 403 Forbidden - PUT https://registry.npmjs.org/package - You do not have permission to publish

# Search npm for the package name
npm search <package-name>

# Or check directly
npm view <package-name>
  1. Check if package name is available
  2. Use a scoped package name
  3. Verify your email
  4. Verify you are logged in as correct user
npm — error
# Search npm for the package name
npm search <package-name>
# Or check directly
npm view <package-name>
npm ERR! code E403
npm ERR! 403 Forbidden - PUT https://registry.npmjs.org/package - You do not have permission to publish

What this error means

The E403 error indicates you're authenticated but not authorized to publish this specific package. The most common cause is that the package name is already taken by another user. Other causes include unverified email, wrong user account, or missing organization permissions. This is an authorization issue, not an authentication issue—npm recognizes who you are, but won't let you publish this package.

Typical symptoms

  • npm publish fails with "403 Forbidden"
  • Error says "You do not have permission to publish"
  • Same version republish fails
  • Scoped package fails while unscoped works (or vice versa)
  • CI/CD pipeline fails at publish step
  • Works locally but fails in CI

Common causes

  1. Package name already taken by another user
  2. Email not verified on npm account
  3. Logged in as wrong user
  4. Trying to republish same version number
  5. "private": true set in package.json
  6. No permission to publish to organization scope
  7. Wrong registry configured

How to fix "npm ERR! code E403 npm ERR! 403 Forbidden - PUT https://registry.npmjs.org/package - You do not have permission to publish"

1Check if package name is available

Search for existing packages:

bash
# Search npm for the package name
npm search <package-name>

# Or check directly
npm view <package-name>

If it exists, you'll need a different name or use a scoped package.

2Use a scoped package name

Scoped packages include your username/org:

json
{
  "name": "@yourusername/package-name",
  "version": "1.0.0"
}

Publish with public access:

bash
npm publish --access public
3Verify your email

npm requires verified email to publish:

1. Go to npmjs.com
2. Log in to your account
3. Check for email verification banner
4. Click verification link in your email

Then retry:

bash
npm publish
4Verify you are logged in as correct user

Check your current login:

bash
# Check who you're logged in as
npm whoami

# If wrong user, log out and log in
npm logout
npm login
5Increment version number

You cannot republish the same version:

bash
# Increment version
npm version patch  # 1.0.0 -> 1.0.1
# or
npm version minor  # 1.0.0 -> 1.1.0

# Then publish
npm publish
6Remove private flag

Check package.json for private setting:

json
{
  "name": "my-package",
  "private": false  // Remove or set to false
}

The "private": true setting prevents publishing.

7Check organization permissions

For org-scoped packages (@org/package):

1. Go to npmjs.com/org/[your-org]
2. Check you're a member with publish permissions
3. Ask org admin to add you if needed

Verify with:

bash
npm team ls @org:developers

Advanced notes

For GitHub Packages publishing:

json
{
  "name": "@username/package",
  "publishConfig": {
    "registry": "https://npm.pkg.github.com"
  }
}

Requires a Personal Access Token with write:packages scope.

For CI/CD, the token must have publish permissions. In GitHub Actions, use:

yaml
permissions:
  packages: write

If publishing to both npm and GitHub Packages, configure separate registries for each scope in .npmrc.

Frequently asked questions

What does "npm ERR! code E403 npm ERR! 403 Forbidden - PUT https://registry.npmjs" mean?
The E403 error indicates you're authenticated but not authorized to publish this specific package. The most common cause is that the package name is already taken by another user. Other causes include unverified email, wrong user account, or missing organization permissions.
How do I fix "npm ERR! code E403 npm ERR! 403 Forbidden - PUT https://registry.npmjs"?
The 403 Forbidden error when publishing occurs when the package name is taken, your email isn't verified, or you lack organization permissions. Try using a scoped package name.
What causes "npm ERR! code E403 npm ERR! 403 Forbidden - PUT https://registry.npmjs"?
Package name already taken by another user Email not verified on npm account Logged in as wrong user
Is the "npm ERR! code E403 npm ERR! 403 Forbidden - PUT https://registry.npmjs" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading