npm install fails with 'npm ERR! code E401 Unable to authenticate' or 'E403 403 Forbidden' for a private registry or scoped package (GitHub Packages, Artifactory, Nexus, Azure Artifacts). How do I configure .npmrc auth correctly?

Cause: npm reached the registry but the credentials were missing, wrong, expired, or not sent for that registry. Common reasons: the scope (@myorg) isn't mapped to the private registry, so npm asks the public registry; the auth token line in .npmrc doesn't match the registry URL exactly (protocol-less '//host/path/:_authToken=' must match the registry's path); an expired or revoked token; a token without read permission for that package; or CI running without the token environment variable. E403 means authenticated but not allowed (permissions, or publishing a name you don't own). Fix: 1. Map the scope to its registry in the project's .npmrc: @myorg:registry=https://npm.example.com/ (for GitHub Packages: @OWNER:registry=https://npm.pkg.github.com). 2. Add the token for that exact registry, preferably from an environment variable so it's never committed: //npm.example.com/:_authToken=${NPM_TOKEN}. npm expands ${VAR} in .npmrc values. 3. Check what npm actually uses: npm config get @myorg:registry, npm config list (secrets are hidden), and npm whoami --registry=https://npm.example.com/ to test the credentials. 4. In CI, set NPM_TOKEN as a secret and make sure the job uses the project's .npmrc (setup-node's registry-url option writes one that reads NODE_AUTH_TOKEN). Use a token with read access to the packages, and check its expiry. 5. Clear stale state if a token changed: remove old entries for the host from ~/.npmrc, and re-run npm login --registry=... for interactive use. 6. Never commit real tokens to .npmrc; if one was committed, revoke it and create a new one. Verify: npm whoami --registry=<url> returns your user or token identity, and npm install fetches the scoped package. Sources: https://docs.npmjs.com/cli/v10/configuring-npm/npmrc https://docs.npmjs.com/cli/v10/using-npm/registry