Unable to install @github/copilot-sdk from npm.pkg.github.com (403 / 401 despite valid auth)

[TauqeerAhmad5201]

Hello,

I’m trying to install @github/copilot-sdk from GitHub Packages but consistently hit authentication/authorization errors, even though repository access and npm auth appear to be configured correctly.

What works

• I can access https://github.com/github/copilot-sdk in the browser
• I have an active GitHub Copilot subscription
• npm is correctly picking up my ~/.npmrc configuration
• Token is detected by npm (npm config list shows authToken as protected)

What fails

Installing the package:
npm install @github/copilot-sdk

Results in:
401 Unauthorized / 403 Forbidden
unauthenticated: User cannot be authenticated with the token provided
→ 403 Forbidden

Also:
npm whoami --registry=https://npm.pkg.github.com

Environment

• OS: macOS
• Node.js: v25.6.0
• npm: 11.8.0
• Registry: https://npm.pkg.github.com
• Auth: Personal Access Token (classic) with read:packages + repo
• Token authorized for SSO (if applicable)

Question

Is access to the npm package gated separately from repository access for the Copilot SDK technical preview?
If so, is there an additional enablement or allowlisting step required to install the package via GitHub Packages?

Happy to provide more details if needed. Thanks!

[github-actions]

Thanks for opening this issue, @TauqeerAhmad5201!

I've labeled this as sdk/nodejs, question, and documentation since you're asking about npm package installation and authentication requirements from GitHub Packages.

Your issue is well-detailed with environment info and what you've tried. A maintainer will help clarify whether there are additional access requirements for installing from npm.pkg.github.com beyond repository access, or if the package should be available through a different installation method.

AI generated by Issue Triage Agent

[devm33]

Hi @TauqeerAhmad5201, the Copilot SDK is published to the npm registry https://www.npmjs.com/package/@github/copilot-sdk not the GitHub Packages npm.pkg.github.com registry.