What happened

v0, Vercel’s AI app builder, can now install packages from private npm registries and custom registries while it generates your app. npm is the standard catalog most JavaScript and TypeScript projects pull reusable code from; a private registry is the same idea, restricted to packages your company hasn’t published publicly, like an internal design system or component library. Vercel’s changelog entry says the credentials come from “shared environment variables,” team-level settings that v0 uses for registry authentication instead of requiring a password or key in each session.

There are two ways to set it up. NPM_TOKEN covers private packages hosted on npm’s own registry, npmjs.org. NPM_RC is for anything more custom, like an organization’s own package scope on GitHub Packages, or a private registry run through a service like JFrog Artifactory. Both get added as shared team environment variables on Vercel, scoped to Development and/or Preview, the pre-launch environments Vercel uses for work in progress and shareable test links, as opposed to Production, the live environment your real users hit. Vercel says credentials can be marked “sensitive,” and that v0 never exposes them to the underlying model or writes them to the sandbox filesystem it generates code in.

Why it matters

Shared registry credentials let v0 install internal component libraries and private design-system packages directly. Teams can use their existing packages without putting a registry token in a prompt or generated code.

Registry credentials need protection beyond the installation workflow. Vercel’s current environment-variable documentation distinguishes readable Config values from write-only Secret values. Existing Sensitive variables are treated as Secrets, and manually created Secrets can be used in Development. Authorized members can read a Config value after saving; storing a token as a Secret hides that saved value.

Vercel lists Development and Preview scopes for these credentials. Confirm the production setup before relying on the token in your live app.

Who should care

Anyone building with v0 on a codebase that depends on private or internal packages, and anyone on a team where more than one person has access to the Vercel project’s environment variable settings.

What builders should do next

Create NPM_TOKEN or NPM_RC in Team Settings → Environment Variables, choose the required environments, and link only the projects that need it. Store credentials as Secret values before saving; an older interface may use the Sensitive label. Confirm the installation from v0 and check Settings → Integrations for the npm integration status.

If your registry supports it, use a read-only token limited to the packages v0 needs. A correctly scoped read-only token should permit package downloads without publishing or access to unrelated packages. Verify the permissions in your registry rather than assuming the label restricts every operation.

Correction, October 13, 2026: Shared registry credentials are configured at the team level and linked to projects. Current Vercel settings distinguish readable Config values from write-only Secrets.

End of article