How to fix npm ERR! code E401 npm ERR! 401 Unauthorized - GET https://registry.npmjs.org/@scope/package in npm

npmINTERMEDIATEHIGHUpdated Dec 5, 2025· 234 views

npm encountered a 401 Unauthorized HTTP response when attempting to fetch a scoped package. This indicates the registry rejected the request due to missing, invalid, expired, or incorrectly configured authentication credentials.

Quick fix

Fixes npm ERR! code E401 npm ERR! 401 Unauthorized - GET https://registry.npmjs.org/@scope/package

npm whoami
  1. Verify authentication token exists and is valid
  2. Check and fix your .npmrc file configuration
  3. Clear npm cache and reinstall dependencies
  4. For GitHub Actions or CI/CD environments
npm — error
npm whoami
npm ERR! code E401
npm ERR! 401 Unauthorized - GET https://registry.npmjs.org/@scope/package

What this error means

npm encountered a 401 Unauthorized HTTP response when attempting to fetch a scoped package (e.g., @scope/package). This indicates the registry rejected the request due to missing, invalid, expired, or incorrectly configured authentication credentials. The npm client successfully contacted the registry but lacks the proper authentication token to access the private or protected package. This is different from a 404 error—the package exists, but you're not authorized to access it. For private npm packages, GitHub Packages, or other private registries, you must configure authentication tokens in your .npmrc file.

Typical symptoms

  • npm install command fails with 'npm ERR! code E401' and '401 Unauthorized - GET'
  • Error message includes the scoped package name: '@scope/package'
  • Installation works fine for public packages but fails for scoped packages
  • CI/CD pipelines fail during npm install despite working locally
  • npm login appears successful but subsequent installs still fail

Common causes

  1. No valid authentication token configured in .npmrc for the scoped package registry
  2. npm login credentials have expired or been revoked
  3. Token was generated with insufficient permissions (missing read:packages scope)
  4. .npmrc file contains syntax errors or incorrect registry URL format
  5. Scoped package mapping (@scope:registry) is not configured in .npmrc
  6. Environment variable (NPM_TOKEN) in .npmrc is undefined in CI/CD
  7. Using wrong token type for the registry (GitHub PAT vs npm token)

How to fix "npm ERR! code E401 npm ERR! 401 Unauthorized - GET https://registry.npmjs.org/@scope/package"

1Verify authentication token exists and is valid

First, check if you have a valid login:

bash
npm whoami

For private npm registry, log in with your credentials:

bash
npm login

For GitHub Packages or other registries, log in to that specific registry:

bash
npm login --scope=@your-org --registry=https://npm.pkg.github.com
2Check and fix your .npmrc file configuration

Open your project's .npmrc file or check your global ~/.npmrc file. Ensure it has the correct format:

For npm registry:

bash
//registry.npmjs.org/:_authToken=YOUR_TOKEN_HERE

For scoped packages from a private registry:

bash
@your-scope:registry=https://your-registry.example.com/
//your-registry.example.com/:_authToken=YOUR_TOKEN_HERE

For GitHub Packages:

bash
@your-org:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=YOUR_GITHUB_TOKEN

Key points:
- Use _authToken (not _password) for token-based authentication
- The registry URL must match exactly (including trailing slash)
- Use environment variables for CI/CD: ${NPM_TOKEN}

3Clear npm cache and reinstall dependencies

Clear the npm cache to remove any cached authentication failures:

bash
npm cache clean --force

Delete package-lock.json and node_modules:

bash
rm -rf node_modules package-lock.json
npm install

This forces npm to fetch fresh metadata and use updated credentials.

4For GitHub Actions or CI/CD environments

Set up authentication using environment variables. Do NOT hardcode tokens.

Create .npmrc with variable:

bash
//registry.npmjs.org/:_authToken=${NPM_TOKEN}

Then provide the token via GitHub Actions secrets:

yaml
- name: Install dependencies
  run: npm ci
  env:
    NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

For GitHub Packages with setup-node:

yaml
- uses: actions/setup-node@v3
  with:
    registry-url: 'https://npm.pkg.github.com'
    scope: '@your-org'
- run: npm install
  env:
    NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
5Verify token permissions and expiration

Check your authentication token:

For npm registry:
- Go to https://www.npmjs.com/settings/~/tokens
- Verify token hasn't expired
- Ensure token has read permission for the scoped package

For GitHub Packages:
- If using GITHUB_TOKEN: Verify repo has read permission to the package
- If using personal access token: Ensure it has read:packages scope

If token is expired or lacks permissions, generate a new one and update .npmrc or CI/CD secrets.

6Debug with verbose logging

If the issue persists, run npm with debug logging:

bash
npm install --verbose

Look for:
- The exact registry URL being contacted
- Whether the _authToken is being sent
- The HTTP status codes and response headers
- Which specific package is failing

Advanced notes

Token Expiration: npm tokens don't automatically refresh. When a token expires, npm returns a 401 error. For high-security environments, tokens may have short validity and need regeneration.

Multiple Registries: When you have multiple scopes mapping to different registries, npm uses the most specific scope match.

always-auth Flag: Setting always-auth=true forces npm to send authentication headers even to the default registry. For npm v7+, the default is always-auth=false.

GitHub Packages: GITHUB_TOKEN's read:packages permission is scoped to the repository. If the package is in a different repo/organization, you need a Personal Access Token with read:packages scope instead.

Frequently asked questions

What does "npm ERR! code E401 npm ERR! 401 Unauthorized - GET https://registry.np" mean?
, @scope/package). This indicates the registry rejected the request due to missing, invalid, expired, or incorrectly configured authentication credentials. The npm client successfully contacted the registry but lacks the proper authentication token to access the private or protected package.
How do I fix "npm ERR! code E401 npm ERR! 401 Unauthorized - GET https://registry.np"?
npm encountered a 401 Unauthorized HTTP response when attempting to fetch a scoped package. This indicates the registry rejected the request due to missing, invalid, expired, or incorrectly configured authentication credentials.
What causes "npm ERR! code E401 npm ERR! 401 Unauthorized - GET https://registry.np"?
No valid authentication token configured in .npmrc for the scoped package registry npm login credentials have expired or been revoked Token was generated with insufficient permissions (missing read:packages scope)
Is the "npm ERR! code E401 npm ERR! 401 Unauthorized - GET https://registry.np" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading