Unauthorized when publishing private Package with Personal Access Token

[ladooniani]

I am having an issue with publishing my private Node.js GitHub Packages using Personal access tokens (classic). I am receiving the following error in GitHub Actions publish-gpr:

npm ERR! 401 Unauthorized - PUT https://npm.pkg.github.com/@username%2fmypackage - unauthenticated: User cannot be authenticated with the token provided. npm ERR d with exit code 1.`

I have updated the personal access token several times with the same scope settings of repo and write:packages and read:packages, and replaced it in my .npmrc file and referenced it as an environment variable.

Despite this, I am still receiving the above error when trying to create a new release. The token is not expired and is correct without typos. It is present in GitHub Personal access tokens (classic), but the note says it is Never used. I am also receiving the same error when trying to use npm publish.

.npmrc:

//npm.pkg.github.com/:_authToken=%GITHUB_TOKEN%

.github\workflows\release-package.yml:

name: Node.js Package

on:
  release:
    types: [created]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: 16
      - run: npm ci

  publish-gpr:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: read
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: 16
          registry-url: https://npm.pkg.github.com/
          scope: "@username"
      - run: npm ci
      - run: npm publish
        env:
          NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}

and I have tried:

      env:
         GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

package.json:

{
  "name": "@username/pack",
  "version": "1.0.0",
  "description": "description",
  "main": "index.js",
  "publishConfig": {
    "@username:registry": "https://npm.pkg.github.com"
  },
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "repository": {
    "type": "git",
    "url": "git+https://github.com/username/pack.git"
  },
  "keywords": [
    "keyword"
  ],
  "author": "Author name",
  "license": "ISC",
  "bugs": {
    "url": "https://github.com/username/pack/issues"
  },
  "homepage": "https://github.com/username/pack#readme"
}

Can anyone provide guidance on how to resolve this issue?

[PythonCoderAS]

Did you follow the instructions at https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-npm-registry#authenticating-with-a-personal-access-token? Can you send your .npmrc with tokens replaced with dummy text?

[ladooniani]

Hello! Yes, I've followed 'Authenticating with a personal access token' . .npmrc added.

[PythonCoderAS]

Try modifying your action to be like this:

name: Node.js Package

on:
  release:
    types: [created]

permissions:
  packages: write

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: 16
      - run: npm ci

  publish-gpr:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: read
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: 16
          registry-url: https://npm.pkg.github.com/
          scope: "@username"
      - run: npm ci
      - run: npm publish
        env:
          NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}

[ladooniani]

adding permissions error on existing : repository 'https://github.com/username/my-repositry/' not found

/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +w1a4551c3745530035baj343452a0730f3423s12:refs/tags/mypack-v1.0.0
  remote: Repository not found.
  Error: fatal: repository 'https://github.com/username/my-repositry/' not found
  Error: The process '/usr/bin/git' failed with exit code 128

[PythonCoderAS]

Did you remember to add the .git at the end? Like https://github.com/username/my-repositry.git?

[ladooniani]

I have two repositories with identical setup in their .yml, package.json (added to post) and .npmrc files, with different names and code. One of the repository's package build is successful, but the other is giving me an error 'build repository 'https://github.com/username/mypack/' not found'. git remote -v :

origin https://github.com/username/pack.git (fetch) 
origin https://github.com/username/pack.git (push)

I have attempted to resolve the issue by completely deleting the problematic repository and creating a new one with the same name, but the Error: fatal: repository 'https://github.com/username/pack/' not found still persists in build step. npm ERR! 401 Unauthorized, in publish-gpr does not appear without edits in code or package setup.

I've created another one in this case 'public' repository, following Quickstart for GitHub Packages with @username:registry=https://npm.pkg.github.com in .npmrc
and Publishing a package using a local .npmrc file

echo %GITHUB_TOKEN% show token. echo %NPM_CONFIG_REGISTRY% displays registry.
and same npm ERR! 401 Unauthorizedor Error: Process completed with exit code 1.

[Melv]

Following Quickstart for GitHub Packages on a private repo I also had that error message.
I've solved it to remove the .npmrc from the repo and build it into the gh actions yaml end let _authToken use the provided secrets.GITHUB_TOKEN.

name: Node.js Package

on:
  release:
    types: [created]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: 16
      - run: npm ci
      - run: npm test


  publish-gpr:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: read
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: 16
          registry-url: https://npm.pkg.github.com/
      - run: npm ci
      - run: |
          echo "@username:registry=https://npm.pkg.github.com" >> .npmrc
          echo "//npm.pkg.github.com/:_authToken=${{ secrets.GITHUB_TOKEN }}" >> .npmrc
      - run: npm publish
        env:
          NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}

This solved it from me.

[MalvinJay]

This is indeed what worked after 48 hours of debug releases 😭 . Thanks @Melv

[nikmolnar]

This worked for me too, after running into issues with the quick start action. Why is the quick start broken?

[ahsan-babar]

Worked like a charm! I can feel your pain @MalvinJay 😭
Thank you @Melv

[VishwasShashidhar]

Thank you @Melv! I was stuck with this issue for 24 hours & finally bumped into this solution.

Interestingly, for a different action of mine which uses setup-node@v1, just creating a ~/.npmrc file with the token works. Looks like something has changed since v3.

[mpint]

This worked like a charm, but I was able to replace it by setting NODE_AUTH_TOKEN in the actions/setup-node action along with registry-url and scope.

- name: Setup Node.js
        uses: actions/setup-node@v4
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_PUBLISH_PACKAGES_TOKEN }}
        with:
          node-version: lts/iron
          registry-url: https://npm.pkg.github.com
          scope: "@myorg"

[hivokas]

What worked for me is moving env declaration to the job level:

jobs:
  publish:
    runs-on: ubuntu-latest
    env:
      NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}

[Lionberg]

I solved it by changing _authToken to _auth
using .npmrc
//npm.pkg.github.com/:_auth=$GITHUB_TOKEN$

where GITHUB_TOKEN is your env variable