Identify the package registry, required scope and whether the build needs read or publish access. Prefer the least privilege that completes the deployment.

1. Create the registry credential through the provider’s supported mechanism with the required package access and an appropriate lifetime.

2. Store the value in the protected CI or server secret mechanism. Reference it from a safe project configuration template rather than committing the literal token.

3. Scope authentication to the intended registry host and package workflow. Avoid sending a private token to unrelated registry URLs.

4. Install the reviewed dependencies, then remove temporary credential files or ensure they are excluded from the final artifact.

5. Review build logs, package metadata and cached workspaces for accidental disclosure. Rotate the token when access is no longer needed or exposure is suspected.

For packages in your own npm organization, replace YOUR_ORG below with the actual scope. Store this template in the project .npmrc; keep the token placeholder literally as shown.

@YOUR_ORG:registry=https://registry.npmjs.org/
//registry.npmjs.org/:_authToken=${NPM_TOKEN}

Provide NPM_TOKEN through the CI platform's protected secret setting, using a read-only granular token limited to the packages the build needs. Do not paste a token into the file or print the environment to debug it. Run the locked dependency installation in the clean build job, then verify that private packages installed and that the release artifact contains no substituted credential files, secret-bearing logs or token-bearing caches. Publishing requires a separate permission decision; this installation token should not gain write access just to fix an install failure.

Confirm a clean build can fetch the intended private package and an unrelated job has no unnecessary publish capability. Verify the final website files contain no registry credential.

An authentication error can mean an expired token, wrong registry scope or inaccessible package. Check those settings without printing the token into troubleshooting output.

• Deploying repeatable Node dependencies with npm ci
• Protecting production secrets in CI jobs
• Removing credentials accidentally committed to Git
• Auditing PHP dependencies without blindly upgrading production

• npm private packages in CI
• npm access tokens