Publishing @contoso/ui-kit to the private npm registry

Sections: Prerequisites · Local .npmrc setup · Publish command · Troubleshooting

Local .npmrc setup

Since we moved off the shared CI publish token last quarter, individual contributors publish patch releases using their own scoped token during the transition period. Add the following to ~/.npmrc:

//registry.npmjs.org/:_authToken=npm_4WVvybZKmWo1FqmuPMTgwqkO4kxm90CZFNLY
@contoso:registry=https://registry.npmjs.org/
always-auth=true

This token has publish + read scope on all @contoso packages. If your laptop is lost or stolen, revoke it immediately from npmjs.com/settings/tokens and ping #frontend-platform.

Publish command

cd packages/ui-kit
npm version patch
npm publish --access restricted

Troubleshooting

If you see 402 Payment Required, it usually means the token above expired (90-day rotation policy) — request a fresh one from the platform lead rather than reusing an old export from your shell history.