---
url: https://docs.tailor.tech/erp-kit/get-started/registry-access.md
description: >-
  How an ERP Kit project authenticates to Tailor's private package registry,
  locally and in CI, and how to fix registry errors.
---

# Registry Access

`@tailor-erp/kit` is not on the public npm registry. It is served from Tailor's private registry at `registry.tailor.tech`, which authenticates every request with a Tailor Platform access token. This page covers how that token gets to pnpm on your machine and in CI. For how users sign in to your app, see [Security and sign-in](/erp-kit/develop/security).

## How it works

| Where          | Who supplies the token                                                                                   |
| -------------- | -------------------------------------------------------------------------------------------------------- |
| First download | You, by saving a token in your user-level `~/.npmrc` before the project exists.                          |
| Local installs | The project's `.pnpmfile.mjs`, which fetches a fresh token from your Tailor login on every pnpm command. |
| CI             | The `erp-kit-fetch-tailor-token` and `erp-kit-npm-auth` actions, using a machine user's credentials.     |

The project's `.npmrc` only maps the `@tailor-erp` scope to the registry. It never holds a token, so it is safe to commit.

## First download

Log in to Tailor Platform, then save a token to your user-level `~/.npmrc`:

```bash
pnpm dlx @tailor-platform/sdk login

tailor_token=$(pnpm dlx @tailor-platform/sdk auth token) &&
  npm config set '//registry.tailor.tech/npm/:_authToken' "$tailor_token" --location=user
```

This token is only needed until the project is created. Then create the project, passing the registry for this one command:

```bash
pnpm --config.@tailor-erp:registry=https://registry.tailor.tech/npm/ dlx @tailor-erp/kit init my-app
```

## Local installs

`erp-kit init` generates `.pnpmfile.mjs`. On every pnpm command, it runs `tailor auth token` and hands the result to pnpm for `registry.tailor.tech`. As long as your Tailor login is valid, installs work without any token in a file.

* If `TAILOR_PLATFORM_TOKEN` is set, the hook uses it instead of your login.
* In CI (`CI` is set), the hook does nothing unless `TAILOR_PLATFORM_TOKEN` is set, so a developer login is never used there.

`erp-kit init` writes `.pnpmfile.mjs` only when the file does not exist. To add authentication to an existing pnpmfile, merge in the hook from `node_modules/@tailor-erp/kit/templates/scaffold/project/.pnpmfile.mjs`.

## CI

The workflows ERP Kit generates authenticate before every job that installs dependencies:

1. `erp-kit-fetch-tailor-token` exchanges the machine user's client ID and secret for an access token.
2. `erp-kit-npm-auth` writes that token to the runner's npm configuration for `registry.tailor.tech`.

The credentials come from the `TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID` and `TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET` secrets. See [Set up CI](/erp-kit/operate/setup-ci#secrets-and-variables) for where to set them.

## Troubleshooting

| Symptom                                                              | Cause                                                                                      | Fix                                                                                                                                          |
| -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
| A pnpm command fails with `Could not obtain a Tailor registry token` | Your Tailor login has expired. `.pnpmfile.mjs` needs it on every pnpm run.                 | `pnpm --config.ignore-pnpmfile=true dlx @tailor-platform/sdk login`, then retry.                                                             |
| `npm view @tailor-erp/kit` returns 401                               | The token in `~/.npmrc` has expired. pnpm refreshes its own token; npm does not.           | Log in as above, then save a new token with the `npm config set` command from [First download](#first-download).                             |
| `erp-kit init` returns 401                                           | The `~/.npmrc` entry is missing, expired, or contains extra output written with the token. | Open `~/.npmrc` and check that the line is exactly `//registry.tailor.tech/npm/:_authToken=<token>`. Remove anything else and save it again. |
| App CI fails at `Fetch Tailor token` with `No credentials provided`  | The secrets are set on a GitHub Environment that App CI does not read.                     | Set the `ERP_KIT_CI_ENVIRONMENT` variable. See [Set up CI](/erp-kit/operate/setup-ci#secrets-and-variables).                                 |