# Registries and networking

jup works with the public npm registry by default. It can also use private registries, manager-specific mirrors, authenticated `.npmrc` entries, standard proxies, and custom certificate authorities.

## Choose a registry

Use one npm-compatible registry for package manager metadata and downloads:

```sh
JUP_NPM_REGISTRY=https://registry.example.com jup install
```

To move only one manager, use:

| Variable | Package manager |
| --- | --- |
| `JUP_REGISTRY_NPM` | npm |
| `JUP_REGISTRY_PNPM` | pnpm |
| `JUP_REGISTRY_YARN` | Yarn |

For example:

```sh
JUP_REGISTRY_YARN=https://mirror.example.com/yarn jup yarn --version
```

Run `jup info` to see the registry selected for each manager and where the setting came from.

## Authenticate to a registry

Pass a bearer token in the process environment:

```sh
JUP_NPM_TOKEN="$TOKEN" jup install
```

For basic authentication, set both `JUP_NPM_USERNAME` and `JUP_NPM_PASSWORD`.

jup sends credentials only to the configured registry origin. It removes them before following a redirect to another origin.

## Use existing `.npmrc` settings

jup reads these entries from global, user, and project `.npmrc` files:

- `registry` and `@scope:registry`;
- registry-host/path-scoped `_authToken`, `_auth`, or `username` with `_password`;
- `cafile` or `ca`; and
- `strict-ssl`.

The closest file takes priority. A project `.npmrc` may select a registry but may not provide credentials or certificate settings. jup warns when it ignores a sensitive project entry. Put credentials in your user `.npmrc` or the process environment instead.

User and global credentials remain limited to the host and path prefix in their `.npmrc` key. `jup info` shows which configuration files won without displaying secret values.

## Configure a proxy

jup supports uppercase and lowercase forms of the standard proxy variables:

- `HTTP_PROXY`
- `HTTPS_PROXY`
- `ALL_PROXY`
- `NO_PROXY`

No extra Node.js option is required.

## Trust a company certificate authority

If a TLS-inspecting proxy replaces registry certificates, obtain its PEM certificate bundle and pass it to jup:

```sh
JUP_CAFILE=/path/to/company-ca.pem jup install
```

This replaces the platform trust store for jup's requests.

`JUP_STRICT_SSL=0` disables certificate verification and prints a warning on every run. Use it only to diagnose a certificate problem. Installing the correct CA bundle is the permanent fix.

## Adjust timeout and retries

`JUP_NETWORK_TIMEOUT` sets the connection and idle timeout in milliseconds. The default is 30,000:

```sh
JUP_NETWORK_TIMEOUT=60000 jup install
```

`JUP_NETWORK_RETRIES` sets the total number of attempts for each request. The default is three; zero disables retries:

```sh
JUP_NETWORK_RETRIES=5 jup install
```

jup retries requests only when doing so is safe. HTTP and network errors include the underlying reason, and displayed URLs never include embedded credentials.

For verification keys and policies, read [Download verification](./security). For every supported variable, see [Environment variables](./settings-reference).