> ## Documentation Index
> Fetch the complete documentation index at: https://www.1password.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Use 1Password to securely authenticate npm and pnpm

> Store your registry access token in 1Password then authenticate npm and pnpm with your fingerprint.

The npm shell plugin allows you to use 1Password to securely authenticate
[npm CLI](https://docs.npmjs.com/cli/)
with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in
plaintext.

Follow the instructions to configure your default credentials and source the `plugins.sh` file, then
you'll be prompted to authenticate npm CLI with biometrics.

The npm shell plugin also works with [pnpm](https://pnpm.io/pnpm-cli). Both tools use the same access token item in 1Password. To set up the plugin for pnpm, follow the same steps with `pnpm` in place of `npm`, for example `op plugin init pnpm`.

## Requirements

<ol>
  <li>[Sign up for 1Password.](https://1password.com/pricing/password-manager)</li>
  <li>Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or
  [Linux](https://1password.com/downloads/linux).</li>

  <li>
    Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.42.0 or
    later.

    If you've already installed 1Password CLI, learn how to
    [update your installation](https://www.1password.dev/cli/reference/update.md).
  </li>

  <li>[Connect 1Password CLI with the 1Password app](https://www.1password.dev/cli/app-integration.md).</li>
  <li>[Install npm CLI.](https://docs.npmjs.com/cli/)</li>
</ol>

The following shells are supported:

<ul><li>Bash</li>
<li>Zsh</li>
<li>fish</li></ul>

To use the plugin with pnpm, also [install pnpm](https://pnpm.io/installation).

## Step 1: Configure your default credentials

To get started with the npm shell plugin:

<ol>
  <li>
    Sign in to the 1Password account you want to use with the npm plugin:

    op signin
  </li>

  <li>If you only want to configure the plugin in a specific directory, change to that directory.</li>

  <li>
    Run the command to set up the plugin:

    op plugin init npm
  </li>
</ol>

You'll be prompted to import your npm credentials into 1Password or select an existing 1Password item where
your credentials are saved, then configure when the credentials should be used.

### Step 1.1: Import or select an item

#### Import a new item

If you haven't saved your npm credentials in 1Password yet, select **Import into 1Password**.
Enter your credentials, choose a name for the new 1Password item, and select the vault where you want to save
it.

If 1Password detects your credentials in your local development environment, you'll be automatically prompted
to import them.

#### Select an existing item

If you've already saved your npm credentials in 1Password, select **Search in 1Password**.

You'll see a list of related items and the vaults where they're saved. If you don't see your credentials,
select **Expand search** to browse all items in your account.

### Step 1.2: Set default credential scope

After you select or import your credentials, you'll be prompted to configure when to use the item to
authenticate npm.

<ul><li>**"Prompt me for each new terminal session"** will only configure the credentials for the
duration of the current terminal session. Once you exit the terminal, the default will be removed.</li>
<li>**"Use automatically when in this directory or subdirectories"** will make the credentials the
default in the current directory and all of its subdirectories, as long as no other directory-specific
defaults are set in them. A terminal-session default takes precedence over a directory-specific one.</li>
<li>**"Use as global default on my system"** will set the credentials as the default in all terminal
sessions and directories. A directory-specific default takes precedence over a global one.</li></ul>

To use pnpm, run `op plugin init pnpm` and select the same item.

## Step 2: Source the plugins.sh file

To make the plugin available, source your `plugins.sh` file. For example:

```shell theme={null}
source ~/.config/op/plugins.sh
```

The file path for your `op` folder may vary depending on your [configuration directory](https://www.1password.dev/cli/config-directories.md). `op plugin init` will output a source command with the correct file path.

If this is your first time installing a shell plugin, you'll also need to add the source command to your RC file or shell profile to persist the plugin beyond the current terminal session. For example:

```shell Bash theme={null}
echo "source ~/.config/op/plugins.sh" >> ~/.bashrc && source ~/.bashrc
```

```shell Zsh theme={null}
echo "source ~/.op/plugins.sh" >> ~/.zshrc && source ~/.zshrc
```

```shell Fish theme={null}
echo "source ~/.op/plugins.sh" >> ~/.config/fish/config.fish && source ~/.config/fish/config.fish
```

## Step 3: Use the CLI

The next time you enter a command with npm, you'll be prompted to authenticate with biometrics or system
authentication.

1Password only provides your access token to commands that talk to a registry, such as `install`, `ci`, `publish`, and `view`. See the [full list of commands](#commands-that-use-your-access-token).

## Step 4: Remove imported credentials from disk

After saving your npm credentials in 1Password, you can remove all local copies you previously had stored on
disk.

Access tokens are commonly stored in `~/.npmrc` as an `_authToken` line, or in pnpm's `auth.ini` file. If you remove them, make sure to configure shell plugins for any other tools that read those files.

## Next steps

1Password Shell Plugins support [more than 60 third-party CLIs](https://www.1password.dev/cli/shell-plugins.md#get-started). To see a list of supported CLIs:

```shell theme={null}
op plugin list
```

To choose another plugin to get started with:

```shell theme={null}
op plugin init
```

To use shell plugins for seamless context switching, learn how to configure a plugin in [multiple environments](https://www.1password.dev/cli/shell-plugins/environments.md) or with [multiple accounts.](https://www.1password.dev/cli/shell-plugins/multiple-accounts.md)

## Get help

### Inspect your configuration

To inspect your current npm configuration:

op plugin inspect npm

1Password CLI will return a list of the credentials you've configured to use with npm and their default
scopes, as well as a list of aliases configured for npm.

### Clear your credentials

To reset the credentials used with npm:

op plugin clear npm

You can clear one configuration at a time, in this order of precedence:

<ol><li>Terminal session default</li>
<li>Directory default, from the current directory to `$HOME`</li>
<li>Global default</li></ol>

For example, if you're in the directory `$HOME/projects/awesomeProject` and you have a terminal
session default, directory defaults for `$HOME` and `$HOME/projects/awesomeProject`, and
a global default credential configured, you would need to run `op plugin clear npm` four times
to clear all of your defaults.

To clear your global default credentials, terminal session default, and the defaults for your current directory
at the same time, run `op plugin clear npm --all`.

## Reference

1Password authenticates npm and pnpm by injecting configuration environment variables with your access token directly from your 1Password account. Nothing is written to `.npmrc`.

If you saved your access token in 1Password manually rather than using `op plugin` to import a new item, make sure that your field names match the table below. If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Description |
| - | - |
| Token | The access token for your registry. |
| Organization (optional) | A package scope, without the leading `@`. If set, the token and registry are only used for packages in that scope. |
| Host (optional) | The host or URL of an npm-compatible registry. If you don't include a scheme, `https://` is used. Defaults to `https://registry.npmjs.org/`. |

### npm environment variables

| Variable | Value | When it's set |
| - | - | - |
| `npm_config_//<registry>/:_authToken` | Token | Always |
| `npm_config_@<organization>:registry` | Registry URL | When Organization is set |
| `npm_config_registry` | Registry URL | When Host is set and Organization isn't |

### pnpm environment variables

| Variable | Value |
| - | - |
| `PNPM_CONFIG__AUTH` | The registry URL and token as JSON, scoped to `@<organization>` if Organization is set |

### Commands that use your access token

1Password provides your access token to these npm and pnpm commands:

`access`, `add`, `audit`, `ci`, `cit`, `deprecate`, `dist-tag`, `exec`, `fetch`, `i`, `install`, `install-ci-test`, `install-test`, `it`, `owner`, `pack`, `profile`, `publish`, `search`, `stage`, `team`, `token`, `unpublish`, `update`, `view`, `whoami`

*Thanks to [@dalldrit13](https://github.com/dalldrit13) for
[contributing this plugin!](https://github.com/1Password/shell-plugins/pull/658) Learn how to
[build your own shell plugins](https://www.1password.dev/cli/shell-plugins/contribute.md).*


## Related topics

- [Use 1Password to securely authenticate Terraform](https://www.1password.dev/cli/shell-plugins/terraform.md)
- [Use 1Password to securely authenticate Dogshell](https://www.1password.dev/cli/shell-plugins/datadog.md)
- [Use 1Password to securely authenticate Flyctl](https://www.1password.dev/cli/shell-plugins/flyctl.md)