Version: 10.x

Auth & Registry Settings (.npmrc)

The settings on this page must be configured via .npmrc files. pnpm uses the npm CLI under the hood for publishing, so these settings need to be in a format that npm can read.

For details on how .npmrc files are loaded, see the pnpm config command.

For settings that can be configured in pnpm-workspace.yaml, see Settings (pnpm-workspace.yaml).

Environment variables

Values in .npmrc files may reference environment variables using the ${NAME} syntax.

Since v10.34.2, environment variables are not expanded in the project and workspace .npmrc files (those checked out together with the repository) for the following settings:

registry and proxy URLs (registry, @scope:registry, proxy, https-proxy, http-proxy);
URL-scoped keys (keys starting with //);
credential values (_authToken, _auth, _password, username, tokenHelper, cert, key).

A setting that contains a ${...} placeholder in any of these positions is ignored, and pnpm prints a warning. Repository-controlled .npmrc files must not be able to expand environment variables into the URLs pnpm sends requests to, or into the credentials attached to those requests — otherwise a malicious repository could exfiltrate secrets from your environment (such as CI tokens) to an attacker-controlled registry during installation (GHSA-3qhv-2rgh-x77r).

If your project relied on a committed .npmrc containing a line like //registry.npmjs.org/:_authToken=${NPM_TOKEN}, move the token to a trusted location instead:

Write the token to the global config file before installing (for example, in a CI step):
```
pnpm config set //registry.npmjs.org/:_authToken "$NPM_TOKEN"
```
pnpm config set writes to the global config file by default, not to the project .npmrc, so the token never ends up in the repository.
Or keep the ${NPM_TOKEN} placeholder line, but put it in the user-level ~/.npmrc instead of the repository — environment variables are still expanded there.

Or set the value via an environment variable directly, without any .npmrc entry:

npm_config_//registry.npmjs.org/:_authToken=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

In GitHub Actions, actions/setup-node with the registry-url input writes the auth setting to a user-level .npmrc (referenced by the NPM_CONFIG_USERCONFIG environment variable, which pnpm honors), so authentication via the NODE_AUTH_TOKEN environment variable continues to work.
If you cannot easily modify each CI pipeline, you may declare the project .npmrc trusted by setting a single environment variable in the CI environment (for example, at the organization or workspace level):
```
NPM_CONFIG_USERCONFIG=.npmrc
```
This makes pnpm read the project's .npmrc as the user-level config file (a relative path is resolved against the working directory), so environment variables in it are expanded as before. Because the trust declaration comes from the environment — not from the repository — a malicious repository cannot set it for you.

危険
Only use this in environments that exclusively build trusted repositories. It disables this protection entirely for the checked-out repository, including the restriction that tokenHelper may only be set in user-level config.

The same rule applies to registry and proxy URLs in a project or workspace .npmrc (registry, @scope:registry, proxy, https-proxy, http-proxy). If you used an environment variable to build a registry URL, move the setting to a trusted source — your user-level ~/.npmrc, the global config (pnpm config set "<key>" <value>), a CLI option, or an environment variable. If the URL is not secret, you can also write the resolved value directly in the project .npmrc, since only ${...} placeholders are ignored.

Registry Settings

registry

Default: https://registry.npmjs.org/
Type: url

The base URL of the npm package registry (trailing slash included).

@jsr:registry

Added in: v10.9.0

Default: https://npm.jsr.io/
Type: url

The base URL of the JSR package registry.

<scope>:registry

The npm registry that should be used for packages of the specified scope. For example, setting @babel:registry=https://example.com/packages/npm/ will enforce that when you use pnpm add @babel/core, or any @babel scoped package, the package will be fetched from https://example.com/packages/npm instead of the default registry.

Authentication Settings

<URL>:_authToken

レジストリにアクセスするときに使用する認証用の Bearer トークンを指定します。例:

//registry.npmjs.org/:_authToken=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

環境変数を使用することもできます。例:

//registry.npmjs.org/:_authToken=${NPM_TOKEN}

Since v10.34.2, environment variables are only expanded in trusted locations (the user ~/.npmrc, the global config, CLI options, and npm_config_* environment variables), not in the project or workspace .npmrc. See Environment variables.

Or you may just use an environment variable directly, without changing .npmrc at all:

npm_config_//registry.npmjs.org/:_authToken=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

<URL>:tokenHelper

tokenHelper とは、アクセストークンを出力する実行ファイルです。これは、authToken が一定値ではなく定期的に更新されるような場合に使用します。スクリプトやその他のツールが、既存のリフレッシュトークンを使って新しいアクセストークンを取得できるようになります。

helper へのパスの設定は、引数なしの絶対パスである必要があります。 In order to be secure, it is only permitted to set this value in the user .npmrc. Otherwise a project could place a value in a project's local .npmrc and run arbitrary executables.

デフォルトのレジストリに tokenHelper を設定します：

tokenHelper=/home/ivan/token-generator

指定されたレジストリに tokenHelper を設定します：

//registry.corp.com:tokenHelper=/home/ivan/token-generator

Proxy Settings

https-proxy

Default: null
Type: url

送信する HTTPS リクエストに使用するプロキシ。 If the HTTPS_PROXY, https_proxy, HTTP_PROXY or http_proxy environment variables are set, their values will be used instead.

If your proxy URL contains a username and password, make sure to URL-encode them. 例：

https-proxy=https://use%21r:pas%2As@my.proxy:1234/foo

Do not encode the colon (:) between the username and password.

http-proxy

proxy

Default: null
Type: url

送信する HTTP リクエストに使用するプロキシ。 HTTP_PROXY または http_proxy 環境変数が設定されている場合、プロキシー設定は、内部のリクエストライブラリーに受け渡されます。

local-address

Default: undefined
Type: IP Address

npm レジストリへの接続を行うときに使用するローカルインターフェイスのIPアドレス。

maxsockets

Default: networkConcurrency x 3
Type: Number

origin (protocol/host/port の組み合わせ) ごとに使用する最大接続数です。

noproxy

Default: null
Type: String

プロキシーを使わない TLD をコンマ区切りの文字列で指定します。

SSL Settings

strict-ssl

Default: true
Type: Boolean

HTTPS 経由でレジストリにリクエストを送る際にSSL鍵の検証を行うかどうかを指定します。

Certificate Settings

ca

Default: The npm CA certificate
Type: String, Array or null

レジストリへのSSL接続をするのに信用する署名用CA証明書を指定します。値は PEM フォーマット (Base64エンコードされた X.509 (.CER)) で指定します。例:

ca="-----BEGIN CERTIFICATE-----\nXXXX\nXXXX\n-----END CERTIFICATE-----"

Null に設定すると、既知の登録者のみを許可できます。もしくは、特定の CA 証明書の署名のみを信頼するように設定できます。

証明書の配列を指定することで、複数の信頼する CA を指定することもできます。

ca[]="..."
ca[]="..."

cafile

Default: null
Type: path

ひとつ、もしくは複数のCA 署名用証明書を持つファイルへのパスを指定します。 Similar to the ca setting, but allows for multiple CAs, as well as for the CA information to be stored in a file instead of being specified via CLI.

<URL>:cafile

Define the path to a Certificate Authority file to use when accessing the specified registry. 例:

//registry.npmjs.org/:cafile=ca-cert.pem

<URL>:ca

Added in: v10.25.0

Define an inline Certificate Authority certificate for the specified registry. The value must be PEM-encoded, like the global ca setting, but it only applies to the matching registry URL.

//registry.example.com/:ca=-----BEGIN CERTIFICATE-----...-----END CERTIFICATE-----

cert

Default: null
Type: String

レジストリにアクセスするときに渡すクライアント証明書。値は PEM フォーマット (Base64エンコードされた X.509 (.CER)) で指定します。例:

cert="-----BEGIN CERTIFICATE-----\nXXXX\nXXXX\n-----END CERTIFICATE-----"

It is not the path to a certificate file.

<URL>:cert

Added in: v10.25.0

Define an inline client certificate to use when accessing the specified registry. 例:

//registry.example.com/:cert=-----BEGIN CERTIFICATE-----...-----END CERTIFICATE-----

<URL>:certfile

Define the path to a certificate file to use when accessing the specified registry. 例:

//registry.npmjs.org/:certfile=server-cert.pem

key

Default: null
Type: String

レジストリにアクセスするときに渡すクライアントキー。値は PEM フォーマット (Base64エンコードされた X.509 (.CER)) で指定します。例:

key="-----BEGIN PRIVATE KEY-----\nXXXX\nXXXX\n-----END PRIVATE KEY-----"

It is not the path to a key file. Use <URL>:keyfile if you need to reference the file system instead of inlining the key.

この設定には機密情報が含まれています。 Don't write it to a local .npmrc file committed to the repository.

<URL>:key

Added in: v10.25.0

Define an inline client key for the specified registry URL.

//registry.example.com/:key=-----BEGIN PRIVATE KEY-----...-----END PRIVATE KEY-----

<URL>:keyfile

Define the path to a client key file to use when accessing the specified registry. 例:

//registry.npmjs.org/:keyfile=server-key.pem

Environment variables​

Registry Settings​

registry​

@jsr:registry​

<scope>:registry​

Authentication Settings​

<URL>:_authToken​

<URL>:tokenHelper​

Proxy Settings​

https-proxy​

http-proxy​

proxy​

local-address​

maxsockets​

noproxy​

SSL Settings​

strict-ssl​

Certificate Settings​

ca​

cafile​

<URL>:cafile​

<URL>:ca​

cert​

<URL>:cert​

<URL>:certfile​

key​

<URL>:key​

<URL>:keyfile​

Environment variables

Registry Settings

registry

@jsr:registry

<scope>:registry

Authentication Settings

<URL>:_authToken

<URL>:tokenHelper

Proxy Settings

https-proxy

http-proxy

proxy

local-address

maxsockets

noproxy

SSL Settings

strict-ssl

Certificate Settings

ca

cafile

<URL>:cafile

<URL>:ca

cert

<URL>:cert

<URL>:certfile

key

<URL>:key

<URL>:keyfile