TypeScript (npm)

Pick one of two ways to authenticate the release: OIDC trusted publishing (recommended, no secret to manage) or an npm access token.

Enable publishing#

Turn on Publish to npm on merge in the target's Git settings, or add a publish block:

{
  "targets": {
    "typescript": {
      "packageName": "@acme/api",
      "publish": { "npm": true }
    }
  }
}

With "npm": true, OIDC is used by default. Once enabled, merging the release pull request publishes the package.

Trusted publishing (OIDC)#

Recommended. npm mints a short-lived, provenance-signed credential at publish time, so nothing is stored in your repository.

Make sure the package exists

Trusted publishing attaches to an existing package. If this is the very first publish, either publish 1.0.0 once by hand, or reserve the name on npm.

Add a trusted publisher on npm

On npmjs.com, open the package, then Settings → Trusted Publisher → GitHub Actions and enter:

Organization or user: the owner of your linked repository
Repository: the repository name
Workflow filename: release-please.yml
Environment: leave blank (unless you set releaseEnvironment)

The automated publish runs as the publish job inside release-please.yml, so that is the workflow npm sees. If you also dispatch sdk-release.yml to re-publish a tag by hand, add it as a second trusted publisher.

Keep the default config

{ "targets": { "typescript": { "publish": { "npm": true } } } }

[!NOTE] Trusted publishing needs npm 11.5.1 or newer. The generated workflow upgrades npm automatically before publishing, so you do not have to.

Publishing with an npm token#

Use a token if you cannot enable trusted publishing.

Create an npm token

On npmjs.com, go to Access Tokens → Generate New Token → Granular Access Token (or a Classic Automation token). Give it permission to publish your package.

Add it to the repository

Add the token as a repository secret named NPM_TOKEN. See Adding repository secrets.

Switch the target to token auth

{
  "targets": {
    "typescript": {
      "publish": { "npm": { "authMethod": "access-token" } }
    }
  }
}

The workflow reads the token from NPM_TOKEN as NODE_AUTH_TOKEN.

Notes#

The publish step is idempotent: if the version is already on npm, it is skipped, so re-merges never fail.
Scoped packages (@acme/api) are published with --access public.

Updated Sep 24, 2026