---
title: Private Dependencies
description: Install private npm packages in v0 by configuring NPM_TOKEN or NPM_RC as environment variables.
docs_index: /docs/llms.txt
lastUpdated: 2026-10-08
product: v0
type: integration
prerequisites:
  - /docs/quickstart
related:
  - /docs/sandbox
  - /docs/external-apis
  - /docs/design-systems-2
  - /docs/security
---

> For an index of all documentation, see [/docs/llms.txt](/docs/llms.txt).

v0 can install private npm packages using your repository's existing package manager. During installation, v0 runs the package manager's install command in [Vercel Sandbox](/docs/sandbox) and authenticates registry requests using `NPM_TOKEN` or `NPM_RC`.

## How it works

When your install command needs a private registry, v0 injects the credential from `NPM_TOKEN` or `NPM_RC` at the sandbox's network boundary. Requests to your registry are authenticated as they leave the sandbox, so your install command downloads private packages without any change to how you run it.

The model and agent cannot access the values, and the credentials are not written to the sandbox filesystem.

## Configure a credential

Add `NPM_TOKEN` or `NPM_RC` once as a [shared team environment variable](https://vercel.com/docs/environment-variables/shared-environment-variables), scoped to the Development and/or Preview environment. You can mark the variable as sensitive to hide its value after saving.

Chats in v0.app use these shared variables automatically. For Platform API chats, [enable shared npm access when creating the chat](/docs/api/v2/guides/environment-variables#private-packages).

If a private package fails to install and neither variable is configured, v0 explains in chat how to add one on Vercel. To view or manage the integration, open **Settings** → **Integrations** in v0 and find **npm**.

### NPM\_TOKEN

Use `NPM_TOKEN` for private packages hosted on [`registry.npmjs.org`](https://registry.npmjs.org). Set it to an npm access token with read access to every private package the project installs.

### NPM\_RC

Use `NPM_RC` for another registry or for multiple registries. Set its value to your `.npmrc` contents.

For GitHub Packages:

```ini
@acme:registry=https://npm.pkg.github.com/
//npm.pkg.github.com/:_authToken=${GITHUB_PACKAGES_TOKEN}
```

For a JFrog Artifactory feed:

```ini
@acme:registry=https://acme.jfrog.io/artifactory/api/npm/npm-local/
//acme.jfrog.io/artifactory/api/npm/npm-local/:_authToken=${ARTIFACTORY_TOKEN}
```

`NPM_RC` can reference other shared environment variables using `${VAR}` syntax. v0 expands these references during installation and applies the same credential protections to the referenced values.

This also covers Yarn 2 and later, including a committed `.yarnrc.yml` that references the same variables, such as `npmAuthToken: "${ARTIFACTORY_TOKEN}"`.

> When both `NPM_RC` and `NPM_TOKEN` are set, `NPM_RC` takes precedence.

## Requirements

You need the [Vercel Developer role](https://vercel.com/docs/rbac/access-roles#developer-role) or higher to manage shared environment variables. Every token must have read access to the private packages it authenticates.

## Design systems

[Design System 2.0](/docs/design-systems-2) imports and chats that use a saved design system install private packages with the same shared credential; the design system itself stores no tokens or environment variables. If v0 can't install a private package during an import, it asks you to add or update the shared credential. If you cannot share credentials, attach `.tgz` package archives instead.

[Learn how Vercel handles private npm packages during builds](https://vercel.com/docs/builds/build-features#private-npm-packages)

---

For a semantic overview of all documentation, see [/docs/sitemap.md](/docs/sitemap.md)

For an index of all available documentation, see [/docs/llms.txt](/docs/llms.txt)

For agent-facing discovery, including API and MCP surfaces, see [/docs/agents.md](/docs/agents.md)