Deployment Platforms

A deployment build needs read access when it installs private or entitled LPM.dev Registry packages. Use a read-scoped token, expose it as LPM_TOKEN, and keep it out of source control, images, artifacts, and build caches.

Choose the Install Path

LPM CLI reads LPM_TOKEN directly:

npm install -g @lpm-registry/cli
lpm ci

This is the preferred path for projects that use lpm.lock.

npm, pnpm, and yarn require scoped Registry routing. A placeholder-only .npmrc can be committed:

@lpm.dev:registry=https://lpm.dev/api/registry/
//lpm.dev/:_authToken=${LPM_TOKEN}

The placeholder is safe to commit; the deployment platform expands it at build time. Do not commit an .npmrc generated with a literal token.

Only @lpm.dev/* packages use this route. Public npm packages and other configured scopes keep using their own registries.

Create a Deployment Credential

Create a read-scoped token from personal token settings or the organization's token settings.

Use a dedicated deployment token rather than a full interactive LPM CLI session or a publish-scoped token. Give each independent deployment context its own token when separate revocation and audit history matter.

Vercel

  1. Open the Vercel project.
  2. Go to Settings > Environment Variables.
  3. Add LPM_TOKEN to each deployment environment that installs Registry packages.
  4. Redeploy.

For npm-compatible installs, commit the placeholder-only .npmrc; Vercel's normal install command then receives the token from its build environment.

To install with LPM CLI instead, configure the project's install command:

npm install -g @lpm-registry/cli && lpm ci

Keep the build command separate, such as npm run build.

Netlify

  1. Open the Netlify site.
  2. Go to Site configuration > Environment variables.
  3. Add LPM_TOKEN for the relevant deploy contexts.
  4. Trigger a new deploy.

The placeholder-only .npmrc works with Netlify's npm-compatible dependency install. For an LPM CLI installation, use:

npm install -g @lpm-registry/cli && lpm ci && npm run build

Use that command only when the site's dependency-install configuration delegates installation to the build command; otherwise Netlify's automatic npm-compatible install still needs the placeholder .npmrc. Pin the LPM CLI package version in production build configuration when reproducibility requires a fixed toolchain.

Docker with LPM CLI

Use a BuildKit secret mount. Do not pass LPM_TOKEN through ARG or bake it into an image layer.

# syntax=docker/dockerfile:1.7
FROM node:22-bookworm-slim

RUN npm install -g @lpm-registry/cli
WORKDIR /app

COPY lpm.lock ./
RUN --mount=type=secret,id=lpm_token \
	LPM_TOKEN="$(cat /run/secrets/lpm_token)" \
	lpm fetch --platform linux/x64/glibc

COPY package.json ./
RUN lpm install --offline --frozen-lockfile --prod

COPY . .

CMD ["node", "server.js"]

Supply the secret from the build environment:

docker build --secret id=lpm_token,env=LPM_TOKEN -t myapp .

The token is available only to the lpm fetch process. The following install replays from the populated LPM CLI store without Registry authentication.

Choose a platform matching the runtime image, such as linux/x64/glibc for Debian-based x64 images or linux/x64/musl for Alpine x64 images. See the LPM CLI Docker guide for workspaces, lpm deploy, local dependencies, and platform-specific lockfile fetching.

For the LPM CLI build above, add a .dockerignore so local credentials and environment files never enter the build context:

node_modules
.lpm
.npmrc
.env*
.git

Docker with npm

For a project that deliberately installs through npm, copy only the placeholder .npmrc and mount the token for the install step:

# syntax=docker/dockerfile:1.7
FROM node:22-bookworm-slim

WORKDIR /app
COPY package.json package-lock.json .npmrc ./

RUN --mount=type=secret,id=lpm_token \
	LPM_TOKEN="$(cat /run/secrets/lpm_token)" \
	npm ci

COPY . .
CMD ["node", "server.js"]

The same docker build --secret command supplies the token. This variant must keep the placeholder .npmrc in the build context, so do not exclude it through .dockerignore; verify that it never contains a literal credential.

Credential Hygiene

  • Use read scope for installation-only builds.
  • Do not print LPM_TOKEN or upload .npmrc as an artifact.
  • Do not pass the token through Docker ARG or ENV.
  • Restrict hosted-platform variables to the deployment contexts that need them.
  • Revoke and replace a token after suspected exposure.

See Also