# Registry access (/docs/ship/registry-access)



`@gauntlet/*` and `@app-brew/*` packages install from Appbrew's private registry at **`npm.appbrew.tech`**. Everything else installs from the public npm registry as usual. Your repo arrives with this fully configured. Knowing what it sets up lets you debug it and reuse it in your own CI.

## What your .npmrc does [#what-your-npmrc-does]

Your repo's committed `.npmrc` does three things:

1. **Routes the two scopes** to the private registry (`@gauntlet:registry` and `@app-brew:registry` pointing at `https://npm.appbrew.tech/`).
2. **Authenticates** with a **read-only token**. Repos Appbrew provisions for you carry it committed alongside the routing: it can install packages and nothing else, which is why committing it is safe. Every clone and every CI run installs without per-machine setup. If your repo has the routing but no token line, ask Appbrew for one and add it.
3. **Pins `node-linker=hoisted`** — a build requirement, not an auth concern. [Do not change it](/docs/ship/your-app-repo).

## Using it in your own CI [#using-it-in-your-own-ci]

Nothing extra is needed: the committed token authenticates CI installs the same way it does your laptop. Keep using `pnpm install` (the repo's lockfile and linker settings assume pnpm).

If your organization requires secrets to live in CI configuration instead of the repo, set the token via an environment override rather than editing `.npmrc`. Ask your Appbrew contact for the current recommended override for your setup.

## When installs fail with 401 or 403 [#when-installs-fail-with-401-or-403]

The token has been rotated, or your repo never carried one. [Contact Appbrew](/docs/start/getting-help) for a fresh token; it arrives as a repo update or a line to paste. Until then, installs of `@gauntlet`/`@app-brew` packages fail while public packages keep working. That's the giveaway.

## Read vs publish [#read-vs-publish]

The committed token is read-only. Publishing (for partner packages) happens only inside your repo's Release workflow with Appbrew-held credentials ([Publishing your package](/docs/ship/publishing-packages)). There is nothing to configure and no publish token to request.