Customer SDKs
Grant packages without repo invites.
Ship customer-specific npm packages while keeping source code, scopes, and access policy under your control.
Private npm-compatible packages without registry pain
Private TypeScript package distribution.
PackagePass gives engineering teams a programmable registry for customer SDKs, generated libraries, preview packages, and internal TypeScript modules. Publish once, grant precisely, install with the package manager developers already use.
npm
pnpm, Yarn, Bun
API
grants and tokens
Audit
release history
Why teams use it
Package access should match your product relationships.
Private registries usually understand packages and users. PackagePass also understands customers, agents, services, preview environments, and CI workflows.
Generated code
Turn generated TypeScript into releases.
Validate manifests, block risky package defaults, publish previews, and promote stable versions.
Internal platforms
Make shared libraries easier to operate.
Manage auth clients, design systems, API clients, and utilities with package-level audit trails.
Workflow
Publish, grant, install, audit.
From the first publish to the last audit event, PackagePass stays in the package workflow instead of asking developers to adopt a new package manager.
01
Publish a scoped package
Release @acme/payments or a preview build from CI.
02
Grant exact access
Give a customer, agent, user, or group only the actions it needs.
03
Install normally
Use .npmrc, pnpm, Yarn, or Bun with scoped registry config.
04
Review the trail
Audit publish, token, grant, install, deprecate, and yanked-version events.
grant-access.ts
import { PackagePassClient } from "@packagepass/sdk";
const registry = new PackagePassClient({
apiKey: process.env.PACKAGEPASS_API_KEY!,
tenant: "acme"
});
await registry.grants.create({
subject: { type: "customer", slug: "globex" },
resource: { type: "package", name: "@acme/payments" },
actions: ["package:install"]
});.npmrc
@acme:registry=https://registry.preview.packagepass.dev/npm/
//registry.preview.packagepass.dev/npm/:_authToken=${PACKAGEPASS_TOKEN}
npm install @acme/paymentsProduct tour
The package, the grant, the token, and the trail in one place.
PackagePass is built around the operating loop teams repeat for customer SDKs and generated TypeScript: publish a package, grant a subject, mint a scoped token, and inspect what happened.
dashboard.packagepass.dev
Packages
@acme/payments
Track private packages, release versions, preview channels, visibility, and active access.
4.8.1
latest
Package
Version
Visibility
Access
@acme/payments
latest 4.8.1
private
12 rules
@acme/auth
preview-pr-482
private
5 rules
@acme/webhooks
latest 2.3.0
internal
8 rules
dashboard.packagepass.dev
Access
Access by subject
Grant exact actions to customers, agents, groups, and users without broad registry membership.
3
subject types
Type
Subject
Action
Resource
customer
globex
package:install
@acme/payments
agent
release-bot
package:publish
@acme/*
group
platform
grant:manage
@acme/auth
dashboard.packagepass.dev
Tokens
Short-lived install access
Issue install, CI, and API tokens scoped to the smallest resource and workflow that needs them.
30d
install token
Kind
Name
TTL
Scope
install
globex payments
30 days
@acme/payments
ci
github release
15 min
@acme/*
api
sdk onboarding
30 days
tenant
dashboard.packagepass.dev
Audit
Policy and release history
Review publish, grant, token, install, dist-tag, deprecate, yank, and policy decision events.
50
recent events
Event
Resource
Actor
package.published
@acme/payments
release-bot
grant.created
customer:globex
devex@acme.com
policy.allowed
package:install
customer:globex
For teams shipping packages as product surface area