npm OIDC API
OpenID Connect token exchange for trusted publishing. Exchange OIDC identity tokens from supported CI/CD providers for short-lived npm registry access tokens.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/npm:npm-oidc-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Npm OIDC API
version: 1.0.0
x-refined-note:
- x-logo differs across the merged source definitions and was not carried
- x-source differs across the merged source definitions and was not carried
description: 'Operations tagged OIDC across 3 of this provider''s published API definitions: npm-public-api-openapi.yml, npm-registry-reference-openapi.json, npm-registry-reference-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://registry.npmjs.org
description: npm Public Registry
tags:
- name: OIDC
description: OpenID Connect token exchange for trusted publishing. Exchange OIDC identity tokens from supported CI/CD providers for short-lived npm registry access tokens.
paths:
/-/npm/v1/security/oidc/tokens:
post:
operationId: exchangeOidcToken
summary: Exchange an OIDC token for an npm token
description: Exchanges a valid OIDC identity token from a supported CI/CD provider for a short-lived npm registry access token. The OIDC token must be provided as a Bearer token in the Authorization header. The provider must be pre-configured as a trusted publisher for the target package.
tags:
- OIDC
security:
- oidcBearerAuth: []
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- package
properties:
package:
type: string
description: The name of the package to obtain publishing access for.
responses:
'200':
description: OIDC token exchanged successfully.
content:
application/json:
schema:
type: object
properties:
token:
type: string
description: A short-lived npm access token that can be used for publishing.
'401':
description: Invalid or expired OIDC token.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: OIDC token claims do not match trusted publisher configuration.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
servers:
- url: https://registry.npmjs.org
description: npm Public Registry
/-/npm/v1/oidc/token/exchange/package/{package_name}:
post:
tags:
- OIDC
summary: Exchange OIDC id_token for npm registry token
description: 'Exchange a valid OIDC id_token (provided as a Bearer token) for a short-lived npm registry access token for the specified package.
The returned npm token can also be used for dist-tag operations when its trusted publisher
configuration explicitly grants `manageDistTags`. This permission is disabled by default
and is independent of direct-publish permission.
**OIDC Token Requirements:**
- The Bearer token must be an OIDC id_token from a supported Identity Provider (IdP)
- The `aud` (audience) claim must be set to `npm:registry.npmjs.org`
**Important:** The Bearer token must be an OIDC id_token from an Identity Provider (IdP) npm supports. This endpoint differs from the rest of the API, which expects a standard npm access token.'
operationId: postNpmV1OidcTokenExchangePackageByPackageName
parameters:
- name: package_name
in: path
required: true
schema:
type: string
description: Name of the npm package, url-encoded
security:
- oidcIdToken: []
responses:
'201':
description: Success
content:
application/json:
schema:
type: object
properties:
token_type:
type: string
enum:
- oidc
token:
type: string
created:
type: string
format: date-time
example: '2025-07-18T10:30:00.000Z'
expires:
type: string
format: date-time
example: '2025-07-18T11:30:00.000Z'
required:
- token_type
- token
- created
- expires
'400':
description: Bad request
content:
application/json:
schema:
type: object
properties:
message:
type: string
example: OIDC token exchange error - bad request
'401':
description: Unauthorized
content:
application/json:
schema:
type: object
properties:
message:
type: string
example: OIDC token exchange error - unauthorized
'404':
description: Package not found
content:
application/json:
schema:
type: object
properties:
message:
type: string
example: OIDC token exchange error - package not found
'500':
description: Internal server error
content:
application/json:
schema:
type: object
properties:
message:
type: string
example: OIDC token exchange error - internal server error
x-operation-id-source: normalized
x-operation-id-original: exchangeOidcToken
servers:
- url: https://registry.npmjs.org
components:
schemas:
Error:
type: object
description: An error response from the npm API.
properties:
error:
type: string
description: The error type or code.
message:
type: string
description: A human-readable description of the error.
securitySchemes:
bearerAuth:
type: http
scheme: bearer
description: npm access token provided as a Bearer token. Supports both classic tokens and granular access tokens.
basicAuth:
type: http
scheme: basic
description: Basic authentication using npm username and password.
oidcBearerAuth:
type: http
scheme: bearer
description: OIDC identity token from a supported CI/CD provider, provided as a Bearer token for token exchange.
oidcIdToken:
type: http
scheme: bearer
bearerFormat: JWT
description: 'OIDC id_token from a supported Identity Provider (IdP) such as GitHub Actions, GitLab CI, or CircleCI.
The `aud` (audience) claim must be set to `npm:registry.npmjs.org`.
**Supported Identity Providers:**
- GitHub Actions
- GitLab CI
- CircleCI
'
npmSessionToken:
type: http
scheme: bearer
description: 'Traditional npm session token created via `npm login`.
These tokens are tied to a user account and inherit the user''s permissions.
'
npmAccessToken:
type: http
scheme: bearer
description: 'Granular Access Token (GAT) with fine-grained permissions.
These tokens can be scoped to specific packages and operations.
GATs created with `bypass_2fa: true` cannot perform account,
token, or org/team/package governance write operations — those
requests are rejected with `403 Forbidden`. See the Authentication
section above for the full list.
'
granularAccessToken:
type: http
scheme: bearer
description: 'Granular Access Token (GAT) with fine-grained permissions.
These tokens can be scoped to specific packages and operations.
(Alias for npmAccessToken)
GATs created with `bypass_2fa: true` cannot perform account,
token, or org/team/package governance write operations — those
requests are rejected with `403 Forbidden`.
'
oidcExchangeToken:
type: http
scheme: bearer
description: 'Short-lived npm registry token obtained by exchanging an OIDC id_token
via the `/oidc/token/exchange` endpoint. These tokens are package-scoped
and have limited lifetime (typically 1 hour).
'
externalDocs:
description: npm Public API Documentation
url: https://api-docs.npmjs.com/
x-refined-from:
- npm-public-api-openapi.yml
- npm-registry-reference-openapi.json
- npm-registry-reference-openapi.yml