---
title: Private Dependencies
description: Install private npm packages in v0 by configuring NPM_TOKEN or NPM_RC as environment variables.
product: v0
type: integration
prerequisites:
  - /docs/quickstart
related:
  - /docs/sandbox
  - /docs/external-apis
  - /docs/design-systems-2
  - /docs/security
---

# Private Dependencies



v0 can install private npm packages using your repository's existing package manager. During installation, v0 runs the package manager's install command in [Vercel Sandbox](/docs/sandbox) and authenticates registry requests using `NPM_TOKEN` or `NPM_RC`.

## How it works

When your install command needs a private registry, v0 injects the credential from `NPM_TOKEN` or `NPM_RC` at the sandbox's network boundary. Requests to your registry are authenticated as they leave the sandbox, so your install command downloads private packages without any change to how you run it.

The model and agent cannot access the values, and the credentials are not written to the sandbox filesystem.

## Configure a credential

Add `NPM_TOKEN` or `NPM_RC` once as a [shared team environment variable](https://vercel.com/docs/environment-variables/shared-environment-variables), scoped to the Development and/or Preview environment. You can mark the variable as sensitive to hide its value after saving.

v0 links these variables automatically. If a private package fails to install and neither variable is configured, v0 explains in chat how to add one on Vercel. To view or manage the integration, open **Settings** → **Integrations** in v0 and find **npm**.

### NPM\_TOKEN

Use `NPM_TOKEN` for private packages hosted on [`registry.npmjs.org`](https://registry.npmjs.org). Set it to an npm access token with read access to every private package the project installs.

### NPM\_RC

Use `NPM_RC` for another registry or for multiple registries. Set its value to your `.npmrc` contents.

For GitHub Packages:

```ini
@acme:registry=https://npm.pkg.github.com/
//npm.pkg.github.com/:_authToken=${GITHUB_PACKAGES_TOKEN}
```

For a JFrog Artifactory feed:

```ini
@acme:registry=https://acme.jfrog.io/artifactory/api/npm/npm-local/
//acme.jfrog.io/artifactory/api/npm/npm-local/:_authToken=${ARTIFACTORY_TOKEN}
```

`NPM_RC` can reference other shared environment variables using `${VAR}` syntax. v0 expands these references during installation and applies the same credential protections to the referenced values.

<Callout>
  When both `NPM_RC` and `NPM_TOKEN` are set, `NPM_RC` takes precedence.
</Callout>

## Requirements

You need the [Vercel Developer role](https://vercel.com/docs/rbac/access-roles#developer-role) or higher to manage shared environment variables. Every token must have read access to the private packages it authenticates.

## Design systems

For [Design System 2.0](/docs/design-systems-2) imports, configure `NPM_TOKEN` or `NPM_RC` before importing. If you cannot share credentials, attach `.tgz` package archives instead.

<LearnMore href="https://vercel.com/docs/builds/build-features#private-npm-packages" icon="arrow">
  Learn how Vercel handles private npm packages during builds
</LearnMore>


---

For a semantic overview of all documentation, see [/docs/sitemap.md](/docs/sitemap.md)

For an index of all available documentation, see [/docs/llms.txt](/docs/llms.txt)

For agent-facing discovery, including API and MCP surfaces, see [/docs/agents.md](/docs/agents.md)