KeyKeepernpm
How an agent gets a npm key through KeyKeeper, what to choose on www.npmjs.com, and how KeyKeeper verifies it.
| Template id | npm |
|---|---|
| Field | npm-token → NPM_TOKEN · secret |
| Key looks like | starts with npm_, shown once when created |
| Created at | www.npmjs.com |
| Verified by KeyKeeper | GET https://registry.npmjs.org/-/whoami — reads the npm identity for this token |
| Template checked | 2026-09-15 |
What the agent does
keykeeper providers show npm
keykeeper save --provider npm --from-clipboard --create --purpose "what this task does"
keykeeper run -c npm -- <your command>--provider npm fills in the credential id and the field. The environment
variable is the one npm's own tools read, so nothing has to be mapped.
What only you can do
Sign in to npm with 2FA
Create a granular access token
Choose packages/scopes, permissions, expiry and optional IP ranges
Copy the key, then approve the save in KeyKeeper's window.
What to choose
Select only the packages or scopes needed. Prefer stage-only for reviewable automation, otherwise read-only or package-specific publish. Keep organization access at No access unless required.
The agent is told the same thing. It opens the page for you and says what to pick; it never logs in, passes 2FA or pays on your behalf.
What KeyKeeper checks
- Before writing: the value must look like a npm key (starts with
npm_, shown once when created). A wrong paste is refused before anything is stored, and the agent is told why — without the value. - After saving: KeyKeeper itself sends
GET https://registry.npmjs.org/-/whoamiwith the key in theAuthorizationheader (reads the npm identity for this token). The agent receives accepted, rejected or could not reach — never the value.
Rotation and expiry
No universal expiry policy was confirmed for this credential type. Record the date shown by the provider, or leave it unknown. Rotate or revoke at www.npmjs.com.