Install npm packages from CloudRepo

npm reads CloudRepo like any other npm registry: point npm at the repository, give it the token, and install. This page is for the person whose project installs from a repository. To put packages there, see Publish npm packages.

You need an npm repository and a repository token that reaches it. If you have neither yet: create a repository and create a token. A token that is Read only is enough to install.

Point npm at the repository

Put this in the .npmrc beside your package.json. It sends the packages of your own scope to CloudRepo and everything else to the public npm registry, so no public package has to be in your repository.

.npmrc

@acme:registry=https://your-org.mycloudrepo.io/repositories/your-repo/
//your-org.mycloudrepo.io/repositories/your-repo/:_authToken=${CLOUDREPO_TOKEN}

• Replace @acme with the scope of your private packages.
• npm replaces ${CLOUDREPO_TOKEN} with the environment variable of that name, so the file can be committed without the token in it.
• Keep the trailing / on both lines, and keep the second line identical to the registry URL without https:. npm sends the token only to the registry that line names.
• npm sends the token alone, as _authToken. There is no username.

The repository URL is https://<organization>.mycloudrepo.io/repositories/<repository>/: your organization’s name, then the repository’s name as the admin portal shows it.

Check that CloudRepo accepts the token:

Terminal

npm whoami --registry=https://your-org.mycloudrepo.io/repositories/your-repo/

Expected: npm prints the email address of the account that created the token. A token that is mistyped, expired or revoked fails here (see When npm answers 401, 403 or 404).

Install a package

Terminal

npm install @acme/my-package

Expected: npm adds the package to node_modules and to package.json.

A package without a scope can live in a CloudRepo repository too. npm then needs the repository as its registry for everything, so use registry= in place of the @acme:registry= line:

.npmrc

registry=https://your-org.mycloudrepo.io/repositories/your-repo/
//your-org.mycloudrepo.io/repositories/your-repo/:_authToken=${CLOUDREPO_TOKEN}

A hosted repository holds only what was published to it, so with registry= a public package it does not hold is not found. To install public packages through CloudRepo as well, create an npm proxy repository and use that as the registry.

When npm answers 401, 403 or 404

npm sends _authToken as a Bearer token, and a Bearer token that is mistyped, expired, revoked or from another organization answers 404 Not Found, not 401. npm then reports the package as not found. If npm reports 404 for a package you know exists, check the token first, and then whether the token reaches the repository (a proxy repository it does not reach also answers 404).

Check these in order:

• The token line. Its //your-org.mycloudrepo.io/repositories/your-repo/: prefix must match the registry URL exactly, without https: and with the trailing slash.
• The token. Paste it whole, starting at crp_v1_, and check on the Repository Tokens page that it has not expired or been revoked.
• The repository. A token reaches only the repositories ticked when it was created. A hosted repository it does not reach answers 403 Forbidden, and a proxy repository it does not reach answers 404 Not Found, not 403: if you installed through a proxy and got a 404 with a good token, check that the token includes the proxy.
• The scope. If npm install @acme/my-package answers 404 and the token is good, npm is looking at the public registry: the @acme:registry= line is missing, or names another scope.
• An npm login token. A token from npm login (crn_v1_) works only on the local npm repository you logged in to. A proxy npm repository refuses it with 403. Use a token from Repository Tokens there.

More: Repository tokens, for every client’s credential and the npm login browser flow; Proxy repositories; npm repositories, for publishing, size limits and unpublishing.