# Environment variables

This reference uses jup's `JUP_*` names. Every `JUP_*` variable also accepts the equivalent `COREPACK_*` name for Corepack compatibility. If both are present, `JUP_*` takes priority.

## Project behavior

| Variable | Purpose |
| --- | --- |
| `JUP_ENABLE_PROJECT_SPEC=0` | Ignore package manager declarations in the project. |
| `JUP_ENABLE_STRICT=0` | Allow a command for a different manager than the project declares. |
| `JUP_ENABLE_AUTO_PIN=1` | Add a pin when a project has no package manager declaration. |
| `JUP_ENABLE_PRERELEASES=1` | Include prereleases during automatic version selection. |
| `JUP_FROZEN_LOCKFILE=1` | Refuse to create or update range resolutions in `.corepack.lock`. When unset, jup enables this behavior whenever `CI` is set. |
| `JUP_MINIMUM_RELEASE_AGE=<hours>` | Exclude newer releases from automatic selection. Exact pins and cached releases are unaffected. |
| `JUP_SPEC_FILE=<path>` | Read the project declaration from a specific file instead of discovering `package.json`. |

## Cache and resolution

| Variable | Purpose |
| --- | --- |
| `JUP_HOME=<path>` | Change the cache, signing-key, and global-fallback directory. |
| `JUP_ENABLE_NETWORK=0` | Block every network request. Required releases must already be cached. |
| `JUP_DEFAULT_TO_LATEST=0` | Use jup's built-in fallback rather than looking up the latest stable release. |
| `JUP_SHIM_DIRECTORY=<path>` | Set the default directory used by `jup enable` and `jup disable`. |

## Registry and authentication

| Variable | Purpose |
| --- | --- |
| `JUP_NPM_REGISTRY=<url>` | Set the npm-compatible registry used for package manager metadata. |
| `JUP_REGISTRY_NPM=<url>` | Override the download base for npm only. |
| `JUP_REGISTRY_PNPM=<url>` | Override the download base for pnpm only. |
| `JUP_REGISTRY_YARN=<url>` | Override the download base for Yarn only. |
| `JUP_NPM_TOKEN=<token>` | Send bearer authentication to the configured registry origin. |
| `JUP_NPM_USERNAME=<name>` | Set the basic-auth username. Requires `JUP_NPM_PASSWORD`. |
| `JUP_NPM_PASSWORD=<password>` | Set the basic-auth password. Requires `JUP_NPM_USERNAME`. |

## Network and TLS

| Variable | Purpose |
| --- | --- |
| `JUP_CAFILE=<path>` | Use a PEM certificate bundle instead of the platform trust store. |
| `JUP_STRICT_SSL=0` | Disable TLS certificate verification and print a warning. |
| `JUP_NETWORK_TIMEOUT=<ms>` | Set connection and idle timeouts. The default is `30000`. |
| `JUP_NETWORK_RETRIES=<count>` | Set total request attempts. The default is `3`; `0` disables retries. |

jup also supports uppercase and lowercase `HTTP_PROXY`, `HTTPS_PROXY`, `ALL_PROXY`, and `NO_PROXY`.

## Verification and downloads

| Variable | Purpose |
| --- | --- |
| `JUP_ENABLE_DOWNLOAD_PROMPT=1` | Announce downloads and request confirmation on an interactive terminal. |
| `JUP_REQUIRE_SIGNATURES=1` | Reject registry metadata without a valid signature. |
| `JUP_ALLOW_UNVERIFIED=1` | Allow an artifact with no usable signature or digest and print a warning. |
| `JUP_INTEGRITY_KEYS=<json>` | Replace the trusted registry signing keys. `0` disables signature verification. |
| `JUP_ENABLE_UNSAFE_CUSTOM_URLS=1` | Allow known package managers to use custom URLs. |

The variables in this section change what jup trusts. Set them only in the process environment. jup ignores them when they come from a project's `.corepack.env`.

## Env files

A repository may place non-sensitive behavior settings in `.corepack.env`:

```dotenv
JUP_ENABLE_STRICT=0
JUP_NETWORK_TIMEOUT=60000
```

jup uses the closest matching file between the current directory and project root. Set `JUP_ENV_FILE` to another filename or path, or set it to `0` to disable env files.

Process environment values take priority over env-file values. jup ignores credentials, trust configuration, certificate settings, unverified-download flags, and unsafe URL controls from a repository env file.

## Variables set by jup

These variables are primarily for package managers and shims rather than manual configuration:

| Variable | Purpose |
| --- | --- |
| `JUP_ROOT` | Identifies the jup installation used by a shim. The compatible `COREPACK_ROOT` form is also passed to child processes. |
| `JUP_MIGRATE_FROM` | Carries migration context into a package manager setup command. |
| `JUP_NODE_EXECPATH` | Selects the Node.js executable used for a JavaScript package manager. |

Use `jup info` or `jup info --json` to inspect the effective configuration. Credentials are reported only as present or absent.