JavaScript / Node.js

CloudRepo supports the npm registry protocol for hosting private Node.js packages.

Overview

CloudRepo provides private npm registry hosting with support for all major JavaScript package managers. Whether you’re using npm, Yarn, pnpm, or Bun, CloudRepo integrates seamlessly with your workflow.

Supported Package Formats

Tarballs (.tgz) - Standard npm package format
Scoped packages - @scope/package-name fully supported
Unscoped packages - Standard package-name format

Supported Tools

npm - The default Node.js package manager
Yarn (v1 and v2+) - Facebook’s package manager
pnpm - Fast, disk-efficient package manager
Bun - All-in-one JavaScript runtime with built-in package manager

Repository Types

Local Repositories

Host your private npm packages:

https://[org-id].mycloudrepo.io/repositories/npm-repo

Features:

Full npm publish and install support
Scoped and unscoped packages
Bearer token authentication (via npm login)
Basic authentication support
HTML directory browsing
210 MB maximum package size

Quick Configuration Examples

npm

; .npmrc
registry=https://[org-id].mycloudrepo.io/repositories/npm-repo/
//[org-id].mycloudrepo.io/repositories/npm-repo/:_authToken=YOUR_TOKEN

Yarn (v2+)

# .yarnrc.yml
npmRegistryServer: "https://[org-id].mycloudrepo.io/repositories/npm-repo/"
npmRegistries:
  "https://[org-id].mycloudrepo.io/repositories/npm-repo/":
    npmAuthToken: "YOUR_TOKEN"

pnpm

; .npmrc (pnpm uses .npmrc)
registry=https://[org-id].mycloudrepo.io/repositories/npm-repo/
//[org-id].mycloudrepo.io/repositories/npm-repo/:_authToken=YOUR_TOKEN
always-auth=true

Bun

; .npmrc (Bun falls back to .npmrc)
registry=https://[org-id].mycloudrepo.io/repositories/npm-repo/
//[org-id].mycloudrepo.io/repositories/npm-repo/:_authToken=YOUR_TOKEN
always-auth=true

Authentication Methods

Bearer Token via `npm login` (Recommended for interactive use)

Configure your registry first, pointing at a local npm repository, then run npm login:

npm config set registry=https://[org-id].mycloudrepo.io/repositories/npm-repo/
npm login

The CLI opens https://admin.cloudrepo.io/npm-login in your browser; sign in with your CloudRepo email and password, click Authorize, and the token lands in ~/.npmrc automatically. That token starts with crn_v1_, works only on the local npm repository you logged in to, and is read-only unless you choose Read-write when you authorize it and your user has write access. A proxy npm repository refuses an npm login token with 403 (npm_token_not_supported_on_proxy), even though the login itself succeeds; use a repository token there. See npm Client for full details on the flow.

Repository token + `.npmrc` (Recommended for CI/CD)

Create the token in the admin portal, under Repository Tokens in the left nav, scoped to the repositories this workload needs (see Repository Tokens: Create One and Authenticate). npm token create is not supported against CloudRepo registries: it answers 410 Gone and points you at the portal.

Then reference the token in .npmrc:

registry=https://[org-id].mycloudrepo.io/repositories/npm-repo/
//[org-id].mycloudrepo.io/repositories/npm-repo/:_authToken=YOUR_TOKEN

npm sends the token on every request to that registry, installs included, so no always-auth setting is needed.

Basic Authentication (legacy `_auth`)

For older CI tooling that requires Basic auth, use _auth. Its value is the base64 of the email address of the account that created the token (in lower case), a colon, and the token. It does not yet reliably accept a token created by the organization owner account:

echo -n 'you@example.com:YOUR_TOKEN' | base64

registry=https://[org-id].mycloudrepo.io/repositories/npm-repo/
//[org-id].mycloudrepo.io/repositories/npm-repo/:_auth=BASE64_ENCODED

Prefer _authToken with a repository token. It scopes the credential to the repositories you choose and rotates independently from your portal password.

Best Practices

Create a repository token in the admin portal and use it as _authToken for CI/CD pipelines; it is revocable on its own, unlike a password in _auth
Revoke tokens you no longer need with npm token list / npm token revoke <id> against the same --registry
npm login opens the admin portal in your browser, so it needs a browser. In CI, configure .npmrc with a repository token instead
Include a trailing slash on registry URLs
Use scoped packages (@yourorg/package) to avoid name conflicts

Next Steps

npm Repositories - Detailed npm CLI setup and usage guide