Permission permission_denied: The token provided does not match expected scopes.

[aecceyhan]

Select Topic Area

Question

Body

Hello all,

I am login with npm login --scope=@name_of_org --registry=https://npm.pkg.github.com
I type my user name, token and my email.
Then I see that I successfully logged in.

npm install @name_of_org/some_name@1.0.24

I get Permission permission_denied: The token provided does not match expected scopes.

However my token has to allow this operation fas as I know

Also there is no waiting pat request on organization

What I am missing?

[akshay-sood]

Did you ever figure this out? I am also having the exact same issue :(

[cbschuld]

@aecceyhan I am also curious if you figured this out, the fine grained tokens do not seem to play well with the npm private repo(s). Curious if anyone accomplished this?

[GreenPlanet0204]

@aecceyhan I am also having the exact same issue

[aecceyhan]

Hey folks, sorry for the late response. We check the name of the repository and the name on our package JS file is different. So on our case that's why we experience a problem. If this does not fix your issue I am happy to look into the issue together because also I am curious about it.

[Varun-Mehrotra]

I had what seemed like a similar issue, but it just turned out that github packages doesn't support fine grained tokens:
https://docs.github.com/en/packages/learn-github-packages/about-permissions-for-github-packages#about-scopes-and-permissions-for-package-registries

Moving from fine-grained tokens to classic fixed it for me.

[dannymartinm]

Happened to me as well, thank you for the comment! It fixed the issue by using a classic token instead.

[enkechan]

worked fine for me, thx!

[kalnode]

This worked for me too.

[emmsdan]

Same here. this worked for me.

[trinitronx]

Seems that this is still an issue in Sept. 2025.

For Packages access in an Organization, there is an extra setting required:

• Go to: Organization Settings -> Personal Access Tokens (Settings) -> Tokens (Classic)

  • URL:

    https://github.com/organizations/${YOUR_ORG_HERE}/settings/personal-access-tokens?tab=classic
    

• Turn on setting (radio button): Allow access via personal access tokens (classic)

  • Screenshot:

Without this setting, and when trying to use a Classic GitHub token, the following error is returned from the ghcr.io API:

{
  "errors": [
    {
      "code": "DENIED",
      "message": "permission_denied: `ExampleOrg` forbids access via a personal access token (classic). Please use a GitHub App, OAuth App, or a personal access token with fine-grained permissions."
    }
  ]
}

Also, due to the missing fine-grained permissions for packages:read and packages:write, ALL fine-grained tokens will return this error:

{"errors":[{"code":"DENIED","message":"permission_denied: The token provided does not match expected scopes."}]}