npm, pnpm, Yarn, and Bun

Use Depot as your JavaScript registry for private packages, cached npm dependencies, or both through a Virtual repository.

Configure with the Depot CLI

Run depot packages configure with npm, pnpm, yarn, or bun. This example routes all packages through a Virtual repository named team:

depot packages configure npm --org <org-id> --repository team

The command sets the registry and credential in your user .npmrc. npm, Bun, and Yarn Classic save a copy of the token. pnpm gets the current token from the Depot CLI through a tokenHelper entry, so the file doesn't contain the token. Add --auth store to save the token for pnpm too. yarn supports Yarn Classic only. For Yarn 2 and later, see use environment variables with modern Yarn.

To route only one package scope to the repository, add --scope @acme. To save a credential without changing the registry, for example for a separate publish repository, add --auth-only.

npm 11 prints Unknown user config warnings for the tokenHelper entry that pnpm uses and the always-auth entry that Yarn Classic uses. You can ignore these warnings.

Configure npm, pnpm, or Bun

Set a registry in your project's .npmrc. This example routes all npm packages through a Virtual repository named team:

registry=https://packages.depot.dev/<org-id>/npm/team/

Keep the token reference in your user ~/.npmrc:

//packages.depot.dev/<org-id>/npm/team/:_authToken=${DEPOT_TOKEN}

Set DEPOT_TOKEN before installing. The URL path on the auth entry must cover the repository used by the command, including a separate publish target. Remove a saved token or helper entry for that URL before using the environment variable.

Install dependencies with npm install, pnpm install, or bun install.

To route only a private scope, replace registry= with:

@acme:registry=https://packages.depot.dev/<org-id>/npm/internal/

Other packages continue to use the client's default registry. See npm configuration and Bun registry configuration.

Use environment variables with modern Yarn

Yarn 2 and later use .yarnrc.yml:

npmRegistryServer: 'https://packages.depot.dev/<org-id>/npm/team/'
npmAuthToken: '${DEPOT_TOKEN}'
npmAlwaysAuth: true

Set DEPOT_TOKEN before running Yarn. Remove conflicting saved authentication entries before using the environment variable. Yarn Classic reads .npmrc. See Yarn registry settings.

Publish a package

Use a Private repository or a Virtual repository with publishing enabled. Set publishConfig in package.json to keep publishing separate from your install registry:

{
  "name": "@acme/widget",
  "version": "1.0.0",
  "publishConfig": {
    "registry": "https://packages.depot.dev/<org-id>/npm/internal/"
  }
}

Configure your client for internal to authorize that endpoint, then publish using the matching command:

npm publish
pnpm publish
yarn npm publish
bun publish

Yarn Classic uses yarn publish. Don't set "private": true on a package you intend to publish.

Publish from CI with trusted publishing

npm 11.5.1 and later, pnpm 11 and later, and Yarn 4.10 and later can publish from GitHub Actions or GitLab CI/CD without a stored token. Add a trust policy to the Private repository, then remove the token from the publish configuration. See trusted publishing for npm, pnpm, and Yarn.