customer access private npm package

How to give a customer access to one private npm package

Ship private packages to customers without adding them to your source repository or exposing unrelated packages.

Build config Start free

Implementation checklist

Create a package-specific install grant.

Issue an install token that can read only the package the customer purchased.

Send .npmrc setup instructions that do not include repository access.

Keep audit logs for token creation, install success, and denied install attempts.

Step 1

Separate source access from install access

Customers usually need to install the artifact, not browse the source repository. Treat package installs as a distribution workflow with its own permissions and audit trail.

PackagePass keeps install access, tokens, and audit events tied to the package workflow.

Step 2

Grant access to the package, not the organization

A customer-scoped install grant lets a buyer install the package they need while keeping other internal packages private.

grant-access.ts

await registry.grants.create({
  subject: { type: "customer", slug: "globex" },
  resource: { type: "package", name: "@acme/payments" },
  actions: ["package:install"]
});

Step 3

Make revocation boring

The access model should make customer churn, contract changes, trial expiry, and leaked install tokens easy to handle. Revoke the grant or rotate the token without changing package names.

PackagePass keeps install access, tokens, and audit events tied to the package workflow.

FAQ

Why not invite the customer to GitHub?

A repo invite grants collaboration context that many package consumers do not need. PackagePass keeps distribution separate from source control.

Can the customer use npm install normally?

Yes. The customer configures a scoped registry and installs the package with standard npm-compatible tooling.

Next step

Turn the config into controlled package access.

PackagePass adds customer, project, user, and CI grants on top of normal npm-compatible installs.

Create a package Private registry