How to fix npm ERR! code E401 npm ERR! 401 Unauthorized - GET https://registry.npmjs.org/@scope/package in npm

First, check if you have a valid login:

npm whoami

For private npm registry, log in with your credentials:

npm login

For GitHub Packages or other registries, log in to that specific registry:

npm login --scope=@your-org --registry=https://npm.pkg.github.com

Open your project's .npmrc file or check your global ~/.npmrc file. Ensure it has the correct format:

For npm registry:

//registry.npmjs.org/:_authToken=YOUR_TOKEN_HERE

For scoped packages from a private registry:

@your-scope:registry=https://your-registry.example.com/
//your-registry.example.com/:_authToken=YOUR_TOKEN_HERE

For GitHub Packages:

@your-org:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=YOUR_GITHUB_TOKEN

Key points:
- Use _authToken (not _password) for token-based authentication
- The registry URL must match exactly (including trailing slash)
- Use environment variables for CI/CD: ${NPM_TOKEN}

Clear the npm cache to remove any cached authentication failures:

npm cache clean --force

Delete package-lock.json and node_modules:

rm -rf node_modules package-lock.json
npm install

This forces npm to fetch fresh metadata and use updated credentials.

Set up authentication using environment variables. Do NOT hardcode tokens.

Create .npmrc with variable:

//registry.npmjs.org/:_authToken=${NPM_TOKEN}

Then provide the token via GitHub Actions secrets:

- name: Install dependencies
  run: npm ci
  env:
    NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

For GitHub Packages with setup-node:

- uses: actions/setup-node@v3
  with:
    registry-url: 'https://npm.pkg.github.com'
    scope: '@your-org'
- run: npm install
  env:
    NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Check your authentication token:

For npm registry:
- Go to https://www.npmjs.com/settings/~/tokens
- Verify token hasn't expired
- Ensure token has read permission for the scoped package

For GitHub Packages:
- If using GITHUB_TOKEN: Verify repo has read permission to the package
- If using personal access token: Ensure it has read:packages scope

If token is expired or lacks permissions, generate a new one and update .npmrc or CI/CD secrets.

If the issue persists, run npm with debug logging:

npm install --verbose

Look for:
- The exact registry URL being contacted
- Whether the _authToken is being sent
- The HTTP status codes and response headers
- Which specific package is failing