Failed to publish package: 401 Unauthorized when testing apm publish with limited‑scope token

Question

Goal: Determine whether an Atom Package Manager (apm) token limited to the package:write scope is sufficient for executing apm publish without triggering a 401 Unauthorized error when testing integration without production credentials.
Uncertainty: The documented error Failed to publish package: 401 Unauthorized appears when apm receives an HTTP 401 from the registry, but it is unclear whether the response is due to missing authentication entirely or to insufficient token scopes such as missing repo or user permissions.
Questions:

Does a token scoped only to package:write allow apm publish to succeed, or does apm require additional scopes?
If additional scopes are needed, which specific scopes (e.g., repo, user) must be present to avoid the 401 error?
How can one verify the exact scope requirements without exposing production credentials?

Tasadduq Burney · Answer

Answer
A token scoped only to package:write is not sufficient for apm publish. The command fails with a 401 Unauthorized unless the token also includes repository access (public_repo for public packages or repo for private packages) and the user:email scope.
Why the 401 occurs
During apm publish the Atom Package Manager:

Authenticates to the Atom registry using the GitHub personal access token.
  Calls the GitHub API to fetch the authenticated user’s email address (needs user:email).
  Pushes a git tag and creates a release, which requires read/write access to the repository (public_repo or repo).

If any of these calls lack the required scope, GitHub returns HTTP 401, which apm surfaces as “Failed to publish package: 401 Unauthorized”.
Verification steps (safe, no production credentials)

Create a throwaway GitHub account and a test repository matching your package’s visibility (public or private).
  Generate a personal access token with only the package:write scope.
  Run:
    apm login --token <test-token>
apm publish
    Observe the 401 Unauthorized error.
  Revoke that token and create a new one with:
    
      package:write
      public_repo (for a public test repo) or repo (for a private test repo)
      user:email

Repeat apm login and apm publish. The command should succeed without a 401.

Missing diagnostic detail
To give a precise scope recommendation, please confirm whether the package you are publishing is public or private. This determines if public_repo or repo is required.

Failed to publish package: 401 Unauthorized when testing apm publish with limited‑scope token

1 answer

Answer

Why the 401 occurs

Verification steps (safe, no production credentials)

Missing diagnostic detail

Your perspective belongs here.

0 question comments