{"record":{"id":"47d1d73866fec4a9","repo":"nodejs/node","slug":"the-key-option-is-protected-and-cannot-be-retr","errorCode":null,"errorMessage":"The ${key} option is protected, and cannot be retrieved in this way","messagePattern":"The (.+?) option is protected, and cannot be retrieved in this way","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"deps/npm/lib/commands/config.js","lineNumber":202,"sourceCode":"\n      if (!this.npm.config.validate(where)) {\n        log.warn('config', 'omitting invalid config values')\n      }\n    }\n\n    await this.npm.config.save(where)\n  }\n\n  async get (keys) {\n    if (!keys.length) {\n      return this.list()\n    }\n\n    const out = []\n    for (const key of keys) {\n      const val = this.npm.config.get(key)\n      if (isPrivate(key, val)) {\n        throw new Error(`The ${key} option is protected, and cannot be retrieved in this way`)\n      }\n\n      const pref = keys.length > 1 ? `${key}=` : ''\n      out.push(pref + val)\n    }\n    output.standard(out.join('\\n'))\n  }\n\n  async del (keys) {\n    if (!keys.length) {\n      throw this.usageError()\n    }\n\n    const where = this.npm.flatOptions.location\n    for (const key of keys) {\n      this.npm.config.delete(key, where)\n    }\n    await this.npm.config.save(where)","sourceCodeStart":184,"sourceCodeEnd":220,"githubUrl":"https://github.com/nodejs/node/blob/1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e/deps/npm/lib/commands/config.js#L184-L220","documentation":"`npm config get <key>` blocks reading values that isPrivate() flags as sensitive (auth tokens, passwords, _auth, _cert, etc.). This prevents secrets from being printed to stdout/logs. The value is still usable internally; it just cannot be retrieved this way.","triggerScenarios":"Running `npm config get` on a key like _authToken, _auth, _password, //registry/:_authToken, or any key classified private by isPrivate().","commonSituations":"Debugging registry auth; CI scripts that try to echo tokens for verification; automation that assumes all config keys are gettable.","solutions":["Use `npm token list` for registry tokens rather than reading them from config","If you must inspect the value, read the specific .npmrc line directly and handle it as a secret (never log it)","Prefer a secret manager / npm_config_<key> env injection over storing retrievable tokens"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"// Mirror npm's isPrivate check before calling config.get for display\nfunction isPrivate(key, val) {\n  const privateKeys = ['_authToken', '_auth', '_password', '_username', '_cert', '_key', '//']\n  return privateKeys.some(p => key.includes(p)) || (typeof val === 'string' && /token|password|secret/i.test(val))\n}","typeGuard":"function isProtectedConfigKey(key) {\n  return [/_authToken$/, /_auth$/, /_password$/, /_username$/, /_keyfile$/, /_cert$/, /^\\/\\//].some(re => re.test(key))\n}","tryCatchPattern":"try {\n  out.push(npm.config.get(key))\n} catch (e) {\n  if (/protected/i.test(e.message)) { /* skip secret, do not log */ }\n  else throw e\n}","preventionTips":["Never echo auth config to logs or stdout","Use `npm token list` for registry tokens","Mark secret-bearing config in your own tooling and redact it"],"tags":["config","security","secrets","cli","auth"],"backgroundTag":null,"analyzedSha":"1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e","analyzedAt":"2026-08-13T00:53:24.642Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}