Skip to main content

The npm shell plugin allows you to use 1Password to securely authenticate npm CLI with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext.

Follow the instructions to configure your default credentials and source the plugins.sh file, then you'll be prompted to authenticate npm CLI with biometrics.

The npm shell plugin also works with pnpm. Both tools use the same access token item in 1Password. To set up the plugin for pnpm, follow the same steps with pnpm in place of npm, for example op plugin init pnpm.

​
Requirements

  1. Sign up for 1Password.
  2. Install and sign in to 1Password for Mac or Linux.
  3. Install 1Password CLI 2.42.0 or later.
    If you've already installed 1Password CLI, learn how to update your installation.
  4. Connect 1Password CLI with the 1Password app.
  5. Install npm CLI.

The following shells are supported:

  • Bash
  • Zsh
  • fish
To use the plugin with pnpm, also install pnpm.

​
Step 1: Configure your default credentials

To use pnpm, run op plugin init pnpm and select the same item.

​
Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:
The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path. If this is your first time installing a shell plugin, you’ll also need to add the source command to your RC file or shell profile to persist the plugin beyond the current terminal session. For example:

​
Step 3: Use the CLI

1Password only provides your access token to commands that talk to a registry, such as install, ci, publish, and view. See the full list of commands.

​
Step 4: Remove imported credentials from disk

After saving your npm credentials in 1Password, you can remove all local copies you previously had stored on disk.

Access tokens are commonly stored in ~/.npmrc as an _authToken line, or in pnpm’s auth.ini file. If you remove them, make sure to configure shell plugins for any other tools that read those files.

​
Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:
To choose another plugin to get started with:
To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

​
Get help

​
Reference

1Password authenticates npm and pnpm by injecting configuration environment variables with your access token directly from your 1Password account. Nothing is written to .npmrc. If you saved your access token in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below. If the item doesn’t contain a field with the required name, you’ll be prompted to rename one of the existing fields.

​
npm environment variables

​
pnpm environment variables

​
Commands that use your access token

1Password provides your access token to these npm and pnpm commands: access, add, audit, ci, cit, deprecate, dist-tag, exec, fetch, i, install, install-ci-test, install-test, it, owner, pack, profile, publish, search, stage, team, token, unpublish, update, view, whoami

Thanks to @dalldrit13 for contributing this plugin! Learn how to build your own shell plugins.