npm error Unable to authenticate, your authentication token seems to be invalid.

[hellorayza]

Your environment

• verdaccio version: 6.x.x

• node version: null (using docker)
• package manager: null
• os: synology(linux)
• platform: docker
• reverse proxy: no

Describe the bug

web ui and cli can login, but unable publish package

Steps to reproduce

PS E:\code\personal\package-name\dist\package-name> npm login --registry=http://192.168.x.x:xxxx    
npm notice Log in on http://192.168.x.x:xxxx/
Username: ray
Password:                                                                                                                                                                                                    

Logged in on http://192.168.x.x:xxxx/.
PS E:\code\personal\package-name\dist\package-name> npm publish  --registry http://192.168.x.x:xxxx/
.....
npm notice total files: 7043
npm notice
npm notice Publishing to http://192.168.x.x:xxxx/ with tag latest and public access
npm error code E401
npm error Unable to authenticate, your authentication token seems to be invalid.
npm error To correct this please try logging in again with:
npm error   npm login
npm error A complete log of this run can be found in: C:\Users\Administrator\AppData\Local\npm-cache\_logs\2025-04-30T07_19_03_112Z-debug-0.log
PS E:\code\personal\package-name\dist\package-name> 

Expected behavior

publish package

Screenshots, Verdaccio server log, package manager log

logs

verdaccio-5.33-1
date,stream,content
2025/04/30 15:19:13,stdout,"http <-- 401, user: null(172.17.0.1), req: 'PUT /package-name', error: authorization required to publish package package-name"
2025/04/30 15:19:13,stdout,"http <-- 401, user: null(172.17.0.1), req: 'PUT /package-name', error: authorization required to publish package package-name"
2025/04/30 15:19:13,stdout,error--- undefined is forbidden publish for package-name
2025/04/30 15:19:12,stdout,info <-- 172.17.0.1 requested 'PUT /package-name'
2025/04/30 15:18:40,stdout,"http <-- 201, user: ray(172.17.0.1), req: 'PUT /-/user/org.couchdb.user:ray/-rev/undefined', bytes: 173/86"
2025/04/30 15:18:40,stdout,"http <-- 200, user: ray(172.17.0.1), req: 'PUT /-/user/org.couchdb.user:ray/-rev/undefined', bytes: 173/0"
2025/04/30 15:18:40,stdout,info <-- 172.17.0.1 requested 'PUT /-/user/org.couchdb.user:ray/-rev/undefined'
2025/04/30 15:18:40,stdout,"http <-- 304, user: null(172.17.0.1), req: 'GET /-/user/org.couchdb.user:ray?write=true', bytes: 0/0"
2025/04/30 15:18:40,stdout,"http <-- 200, user: null(172.17.0.1), req: 'GET /-/user/org.couchdb.user:ray?write=true', bytes: 0/0"
2025/04/30 15:18:40,stdout,info <-- 172.17.0.1 requested 'GET /-/user/org.couchdb.user:ray?write=true'
2025/04/30 15:18:40,stdout,"http <-- 409, user: null(172.17.0.1), req: 'PUT /-/user/org.couchdb.user:ray', error: username is already registered"
2025/04/30 15:18:40,stdout,error--- the user ray could not being added. Error: username is already registered
2025/04/30 15:18:40,stdout,"http <-- 200, user: null(172.17.0.1), req: 'PUT /-/user/org.couchdb.user:ray', bytes: 129/0"
2025/04/30 15:18:40,stdout,info <-- 172.17.0.1 requested 'PUT /-/user/org.couchdb.user:ray'
2025/04/30 15:18:34,stdout,"http <-- 404, user: null(172.17.0.1), req: 'POST /-/v1/login', bytes: 2/150"
2025/04/30 15:18:34,stdout,"http <-- 200, user: null(172.17.0.1), req: 'POST /-/v1/login', bytes: 2/0"
2025/04/30 15:18:34,stdout,info <-- 172.17.0.1 requested 'POST /-/v1/login'
2025/04/30 15:17:55,stdout,"http <-- 200, user: null(172.17.0.1), req: 'GET /-/static/favicon.ico', bytes: 0/2050"
2025/04/30 15:17:55,stdout,"http <-- 200, user: null(172.17.0.1), req: 'GET /-/static/favicon.ico', bytes: 0/0"
2025/04/30 15:17:55,stdout,info <-- 172.17.0.1 requested 'GET /-/static/favicon.ico'
2025/04/30 15:17:55,stdout,"http <-- 304, user: null(172.17.0.1), req: 'GET /-/verdaccio/data/packages', bytes: 0/0"
2025/04/30 15:17:55,stdout,info --- allowed access for package-name2
2025/04/30 15:17:55,stdout,info --- auth/allow_action: access granted to: undefined
2025/04/30 15:17:55,stdout,"http <-- 200, user: null(172.17.0.1), req: 'GET /-/verdaccio/data/packages', bytes: 0/0"
2025/04/30 15:17:55,stdout,info <-- 172.17.0.1 requested 'GET /-/verdaccio/data/packages'
2025/04/30 15:17:55,stdout,"http <-- 304, user: null(172.17.0.1), req: 'GET /-/static/Home.55cdd4aea43adabcb109.js', bytes: 0/0"
2025/04/30 15:17:55,stdout,"http <-- 200, user: null(172.17.0.1), req: 'GET /-/static/Home.55cdd4aea43adabcb109.js', bytes: 0/0"
2025/04/30 15:17:55,stdout,info <-- 172.17.0.1 requested 'GET /-/static/Home.55cdd4aea43adabcb109.js'
2025/04/30 15:17:55,stdout,"http <-- 304, user: null(172.17.0.1), req: 'GET /-/static/main.55cdd4aea43adabcb109.js', bytes: 0/0"
2025/04/30 15:17:55,stdout,"http <-- 200, user: null(172.17.0.1), req: 'GET /-/static/main.55cdd4aea43adabcb109.js', bytes: 0/0"
2025/04/30 15:17:55,stdout,info <-- 172.17.0.1 requested 'GET /-/static/main.55cdd4aea43adabcb109.js'
2025/04/30 15:17:55,stdout,"http <-- 304, user: null(172.17.0.1), req: 'GET /-/static/vendors.55cdd4aea43adabcb109.js', bytes: 0/0"
2025/04/30 15:17:55,stdout,"http <-- 200, user: null(172.17.0.1), req: 'GET /-/static/vendors.55cdd4aea43adabcb109.js', bytes: 0/0"
2025/04/30 15:17:55,stdout,info <-- 172.17.0.1 requested 'GET /-/static/vendors.55cdd4aea43adabcb109.js'
2025/04/30 15:17:55,stdout,"http <-- 304, user: null(172.17.0.1), req: 'GET /-/static/runtime.55cdd4aea43adabcb109.js', bytes: 0/0"
2025/04/30 15:17:55,stdout,"http <-- 200, user: null(172.17.0.1), req: 'GET /-/static/runtime.55cdd4aea43adabcb109.js', bytes: 0/0"
2025/04/30 15:17:55,stdout,info <-- 172.17.0.1 requested 'GET /-/static/runtime.55cdd4aea43adabcb109.js'
2025/04/30 15:17:55,stdout,"http <-- 304, user: null(172.17.0.1), req: 'GET /', bytes: 0/0"
2025/04/30 15:17:55,stdout,"http <-- 304, user: null(172.17.0.1), req: 'GET /', bytes: 0/0"
2025/04/30 15:17:55,stdout,info <-- 172.17.0.1 requested 'GET /'
2025/04/30 15:16:03,stdout,"http <-- 401, user: null(172.17.0.1), req: 'PUT /package-name', error: authorization required to publish package package-name"
2025/04/30 15:16:03,stdout,"http <-- 401, user: null(172.17.0.1), req: 'PUT /package-name', error: authorization required to publish package package-name"
2025/04/30 15:16:03,stdout,error--- undefined is forbidden publish for package-name
2025/04/30 15:16:02,stdout,info <-- 172.17.0.1 requested 'PUT /package-name'
2025/04/30 15:15:49,stdout,"http <-- 201, user: ray(172.17.0.1), req: 'PUT /-/user/org.couchdb.user:ray/-rev/undefined', bytes: 173/86"
2025/04/30 15:15:49,stdout,"http <-- 200, user: ray(172.17.0.1), req: 'PUT /-/user/org.couchdb.user:ray/-rev/undefined', bytes: 173/0"
2025/04/30 15:15:49,stdout,info <-- 172.17.0.1 requested 'PUT /-/user/org.couchdb.user:ray/-rev/undefined'
2025/04/30 15:15:49,stdout,"http <-- 304, user: null(172.17.0.1), req: 'GET /-/user/org.couchdb.user:ray?write=true', bytes: 0/0"
2025/04/30 15:15:49,stdout,"http <-- 200, user: null(172.17.0.1), req: 'GET /-/user/org.couchdb.user:ray?write=true', bytes: 0/0"
2025/04/30 15:15:49,stdout,info <-- 172.17.0.1 requested 'GET /-/user/org.couchdb.user:ray?write=true'
2025/04/30 15:15:49,stdout,"http <-- 409, user: null(172.17.0.1), req: 'PUT /-/user/org.couchdb.user:ray', error: username is already registered"
2025/04/30 15:15:49,stdout,error--- the user ray could not being added. Error: username is already registered
2025/04/30 15:15:49,stdout,"http <-- 200, user: null(172.17.0.1), req: 'PUT /-/user/org.couchdb.user:ray', bytes: 129/0"
2025/04/30 15:15:49,stdout,info <-- 172.17.0.1 requested 'PUT /-/user/org.couchdb.user:ray'
2025/04/30 15:15:44,stdout,"http <-- 404, user: null(172.17.0.1), req: 'POST /-/v1/login', bytes: 2/150"
2025/04/30 15:15:44,stdout,"http <-- 200, user: null(172.17.0.1), req: 'POST /-/v1/login', bytes: 2/0"
2025/04/30 15:15:44,stdout,info <-- 172.17.0.1 requested 'POST /-/v1/login'
2025/04/30 15:15:36,stdout,"http <-- 401, user: null(172.17.0.1), req: 'PUT /package-name', error: authorization required to publish package package-name"
2025/04/30 15:15:36,stdout,"http <-- 401, user: null(172.17.0.1), req: 'PUT /package-name', error: authorization required to publish package package-name"
2025/04/30 15:15:36,stdout,error--- undefined is forbidden publish for package-name
2025/04/30 15:15:35,stdout,info <-- 172.17.0.1 requested 'PUT /package-name'
2025/04/30 15:15:24,stdout,"http <-- 201, user: ray(172.17.0.1), req: 'PUT /-/user/org.couchdb.user:ray/-rev/undefined', bytes: 173/86"
2025/04/30 15:15:24,stdout,"http <-- 200, user: ray(172.17.0.1), req: 'PUT /-/user/org.couchdb.user:ray/-rev/undefined', bytes: 173/0"
2025/04/30 15:15:24,stdout,info <-- 172.17.0.1 requested 'PUT /-/user/org.couchdb.user:ray/-rev/undefined'
2025/04/30 15:15:24,stdout,"http <-- 304, user: null(172.17.0.1), req: 'GET /-/user/org.couchdb.user:ray?write=true', bytes: 0/0"
2025/04/30 15:15:24,stdout,"http <-- 200, user: null(172.17.0.1), req: 'GET /-/user/org.couchdb.user:ray?write=true', bytes: 0/0"
2025/04/30 15:15:24,stdout,info <-- 172.17.0.1 requested 'GET /-/user/org.couchdb.user:ray?write=true'
2025/04/30 15:15:24,stdout,"http <-- 409, user: null(172.17.0.1), req: 'PUT /-/user/org.couchdb.user:ray', error: username is already registered"
2025/04/30 15:15:24,stdout,error--- the user ray could not being added. Error: username is already registered
2025/04/30 15:15:24,stdout,"http <-- 200, user: null(172.17.0.1), req: 'PUT /-/user/org.couchdb.user:ray', bytes: 129/0"
2025/04/30 15:15:24,stdout,info <-- 172.17.0.1 requested 'PUT /-/user/org.couchdb.user:ray'
2025/04/30 15:15:19,stdout,"http <-- 404, user: null(172.17.0.1), req: 'POST /-/v1/login', bytes: 2/150"
2025/04/30 15:15:19,stdout,"http <-- 200, user: null(172.17.0.1), req: 'POST /-/v1/login', bytes: 2/0"
2025/04/30 15:15:19,stdout,info <-- 172.17.0.1 requested 'POST /-/v1/login'
2025/04/30 15:14:58,stdout,"http <-- 401, user: null(172.17.0.1), req: 'PUT /package-name', error: authorization required to publish package package-name"
2025/04/30 15:14:58,stdout,"http <-- 401, user: null(172.17.0.1), req: 'PUT /package-name', error: authorization required to publish package package-name"
2025/04/30 15:14:58,stdout,error--- undefined is forbidden publish for package-name
2025/04/30 15:14:57,stdout,info <-- 172.17.0.1 requested 'PUT /package-name'
2025/04/30 15:13:11,stdout,"http <-- 304, user: null(172.17.0.1), req: 'GET /-/verdaccio/data/packages', bytes: 0/0"
2025/04/30 15:13:11,stdout,info --- allowed access for package-name2
2025/04/30 15:13:11,stdout,info --- auth/allow_action: access granted to: undefined
2025/04/30 15:13:11,stdout,"http <-- 200, user: null(172.17.0.1), req: 'GET /-/verdaccio/data/packages', bytes: 0/0"
2025/04/30 15:13:11,stdout,info <-- 172.17.0.1 requested 'GET /-/verdaccio/data/packages'
2025/04/30 15:13:11,stdout,"http <-- 304, user: null(172.17.0.1), req: 'GET /-/static/Home.55cdd4aea43adabcb109.js', bytes: 0/0"
2025/04/30 15:13:11,stdout,"http <-- 200, user: null(172.17.0.1), req: 'GET /-/static/Home.55cdd4aea43adabcb109.js', bytes: 0/0"
2025/04/30 15:13:11,stdout,info <-- 172.17.0.1 requested 'GET /-/static/Home.55cdd4aea43adabcb109.js'
2025/04/30 15:13:11,stdout,"http <-- 304, user: null(172.17.0.1), req: 'GET /-/static/main.55cdd4aea43adabcb109.js', bytes: 0/0"
2025/04/30 15:13:11,stdout,"http <-- 200, user: null(172.17.0.1), req: 'GET /-/static/main.55cdd4aea43adabcb109.js', bytes: 0/0"
2025/04/30 15:13:11,stdout,info <-- 172.17.0.1 requested 'GET /-/static/main.55cdd4aea43adabcb109.js'
2025/04/30 15:13:11,stdout,"http <-- 304, user: null(172.17.0.1), req: 'GET /-/static/vendors.55cdd4aea43adabcb109.js', bytes: 0/0"
2025/04/30 15:13:11,stdout,"http <-- 200, user: null(172.17.0.1), req: 'GET /-/static/vendors.55cdd4aea43adabcb109.js', bytes: 0/0"
2025/04/30 15:13:11,stdout,info <-- 172.17.0.1 requested 'GET /-/static/vendors.55cdd4aea43adabcb109.js'
2025/04/30 15:13:11,stdout,"http <-- 304, user: null(172.17.0.1), req: 'GET /-/static/runtime.55cdd4aea43adabcb109.js', bytes: 0/0"
2025/04/30 15:13:11,stdout,"http <-- 200, user: null(172.17.0.1), req: 'GET /-/static/runtime.55cdd4aea43adabcb109.js', bytes: 0/0"
2025/04/30 15:13:11,stdout,info <-- 172.17.0.1 requested 'GET /-/static/runtime.55cdd4aea43adabcb109.js'
2025/04/30 15:13:11,stdout,"http <-- 304, user: null(172.17.0.1), req: 'GET /', bytes: 0/0"
2025/04/30 15:13:11,stdout,"http <-- 304, user: null(172.17.0.1), req: 'GET /', bytes: 0/0"
2025/04/30 15:13:11,stdout,info <-- 172.17.0.1 requested 'GET /'

Configuration file

#
# This is the default config file. It allows all users to do anything,
# so don't use it on production systems.
#
# Look here for more config file examples:
# https://github.com/verdaccio/verdaccio/tree/master/conf
#

# path to a directory with all packages
storage: /verdaccio/storage/data
# path to a directory with plugins to include
plugins: /verdaccio/plugins

# https://verdaccio.org/zh-CN/docs/configuration
# security:
# api:
# migrateToSecureLegacySignature: true

web:
  title: Verdaccio
  html_cache: false
  # comment out to disable gravatar support
  # gravatar: false
  # by default packages are ordercer ascendant (asc|desc)
  # sort_packages: asc
  # convert your UI to the dark side
  # darkMode: true
  # logo: http://somedomain/somelogo.png
  # favicon: http://somedomain/favicon.ico | /path/favicon.ico

# translate your registry, api i18n not available yet
# i18n:
# list of the available translations https://github.com/verdaccio/ui/tree/master/i18n/translations
#   web: en-US

auth:
  htpasswd:
    file: /verdaccio/conf/htpasswd
    algorithm: bcrypt
    # Maximum amount of users allowed to register, defaults to "+inf".
    # You can set this to -1 to disable registration.
    # max_users: 1000

# a list of other known repositories we can talk to
uplinks:
  npmmirror:
    url: https://registry.npmmirror.com/
  npmjs:
    url: https://registry.npmjs.org/

packages:
  "@*/*":
    # scoped packages
    access: $all
    publish: $authenticated
    unpublish: $authenticated
    proxy: npmmirror

  "**":
    # allow all users (including non-authenticated users) to read and
    # publish all packages
    #
    # you can specify usernames/groupnames (depending on your auth plugin)
    # and three keywords: "$all", "$anonymous", "$authenticated"
    access: $all

    # allow all known users to publish/publish packages
    # (anyone can register by default, remember?)
    publish: $authenticated
    unpublish: $authenticated

    # if package is not available locally, proxy requests to 'npmjs' registry
    proxy: npmjs

# You can specify HTTP/1.1 server keep alive timeout in seconds for incoming connections.
# A value of 0 makes the http server behave similarly to Node.js versions prior to 8.0.0, which did not have a keep-alive timeout.
# WORKAROUND: Through given configuration you can workaround following issue https://github.com/verdaccio/verdaccio/issues/301. Set to 0 in case 60 is not enough.
server:
  keepAliveTimeout: 60
  max_body_size: 1000mb

middlewares:
  audit:
    enabled: true

max_body_size: 1000mb
# log settings
log: { type: stdout, format: pretty, level: http }

#experiments:
#  # support for npm token command
#  token: false
#  # disable writing body size to logs, read more on ticket 1912
#  bytesin_off: false
#  # enable tarball URL redirect for hosting tarball with a different server, the tarball_url_redirect can be a template string
#  tarball_url_redirect: 'https://mycdn.com/verdaccio/${packageName}/${filename}'
#  # the tarball_url_redirect can be a function, takes packageName and filename and returns the url, when working with a js configuration file
#  tarball_url_redirect(packageName, filename) {
#    const signedUrl = // generate a signed url
#    return signedUrl;
#  }

# This affect the web and api (not developed yet)
#i18n:
#web: en-US
listen: 0.0.0.0:4873

Debugging output

• $ NODE_DEBUG=request verdaccio display request calls (verdaccio <--> uplinks)
• $ DEBUG=verdaccio* verdaccio enable extreme verdaccio debug mode (verdaccio api)
• $ npm -ddd prints:

npm verbose cli C:\Users\Administrator\AppData\Local\fnm_multishells\32384_1746003449300\node.exe C:\Users\Administrator\AppData\Local\fnm_multishells\32384_1746003449300\node_modules\npm\bin\npm-cli.js
npm info using [email protected]
npm info using [email protected]
npm silly config load:file:C:\Users\Administrator\AppData\Roaming\fnm\node-versions\v18.20.7\installation\node_modules\npm\npmrc
npm silly config load:file:E:\code\fork\element-sharp\.npmrc
npm silly config load:file:C:\Users\Administrator\.npmrc
npm silly config load:file:C:\Users\Administrator\AppData\Local\fnm_multishells\32384_1746003449300\etc\npmrc
npm verbose title npm
npm verbose argv "--loglevel" "silly"
npm verbose logfile logs-max:10 dir:C:\Users\Administrator\AppData\Local\npm-cache\_logs\2025-04-30T09_43_40_880Z-
npm verbose logfile C:\Users\Administrator\AppData\Local\npm-cache\_logs\2025-04-30T09_43_40_880Z-debug-0.log
npm <command>

Usage:

npm install        install all the dependencies in your project
npm install <foo>  add the <foo> dependency to your project
npm test           run this project's tests
npm run <foo>      run the script named <foo>
npm <command> -h   quick help on <command>
npm -l             display usage info for all commands
npm help <term>    search for help on <term> (in a browser)
npm help npm       more involved overview (in a browser)

All commands:

    access, adduser, audit, bugs, cache, ci, completion,
    config, dedupe, deprecate, diff, dist-tag, docs, doctor,
    edit, exec, explain, explore, find-dupes, fund, get, help,
    help-search, hook, init, install, install-ci-test,
    install-test, link, ll, login, logout, ls, org, outdated,
    owner, pack, ping, pkg, prefix, profile, prune, publish,
    query, rebuild, repo, restart, root, run-script, sbom,
    search, set, shrinkwrap, star, stars, start, stop, team,
    test, token, uninstall, unpublish, unstar, update, version,
    view, whoami

Specify configs in the ini-formatted file:
    C:\Users\Administrator\.npmrc
or on the command line via: npm <command> --key=value

More configuration info: npm help config
Configuration fields: npm help 7 config

[email protected] C:\Users\Administrator\AppData\Roaming\fnm\node-versions\v18.20.7\installation\node_modules\npm
npm verbose cwd E:\code\fork\element-sharp
npm verbose os Windows_NT 10.0.26100
npm verbose node v18.20.7
npm verbose npm  v10.8.2
npm verbose exit 1
npm verbose code 1

• $ npm config get registry prints:

https://registry.npmmirror.com/

Contribute to Verdaccio

• I'm willing to fix this bug 🥇

Others

Related References：
#3699
#1526
#5045

tried:

• modify configuration file
• check htpasswd line break

[mbtools]

Because your package access is set to $authenticated, you need to maintain the security section in config:

https://verdaccio.org/docs/configuration#jwt-token-signature

[burloiumarian23]

Thanks . I was having the same issue . However on logout it does not remove the user state properly and the packages are still visible , although they should not . what is it wrong ?

[mbtools]

I'm aware of the issue @burloiumarian23 but haven't had time to fix it. There's something wrong with checking if the token is expired (https://github.com/verdaccio/verdaccio/blob/master/packages/ui-components/src/utils/token.ts, https://github.com/verdaccio/verdaccio/blob/master/packages/ui-components/src/store/models/login.ts). Feel free to debug and suggest a PR

Continue with the existing issue #4078