nocobase/nocobase · error

The saved license key does not include package registry cred

Error message

The saved license key does not include package registry credentials.

What it means

The license plugin's loginPkg exchanges the saved license key's package-registry credentials (accessKeyId/accessKeySecret) with a Verdaccio login endpoint. If the saved license key data lacks either credential, it throws this plain Error. The license key is valid but does not carry npm-registry credentials, so private packages cannot be fetched.

Source

Thrown at packages/core/cli/src/commands/license/plugins/shared.ts:92

async function pathExists(target: string): Promise<boolean> {
  try {
    await access(target);
    return true;
  } catch {
    return false;
  }
}

function trimString(value: unknown): string | undefined {
  const text = String(value ?? '').trim();
  return text || undefined;
}

async function loginPkg(baseURL: string, keyData: LicenseKeyData): Promise<string> {
  const username = String(keyData.accessKeyId ?? '').trim();
  const password = String(keyData.accessKeySecret ?? '').trim();
  if (!username || !password) {
    throw new Error('The saved license key does not include package registry credentials.');
  }

  const response = await fetch(`${baseURL}-/verdaccio/sec/login`, {
    method: 'POST',
    headers: {
      'content-type': 'application/json',
    },
    body: JSON.stringify({ username, password }),
  });
  if (!response.ok) {
    throw new Error(`Package registry login failed with status ${response.status}.`);
  }
  const data = await response.json();
  const token = String(data?.token ?? '').trim();
  if (!token) {
    throw new Error('Package registry login did not return a token.');
  }
  return token;

View on GitHub (pinned to fa42722fef)

Solutions

1. Re-obtain and re-save a license key that includes package registry credentials (re-activate the license).
2. Verify the key data contains accessKeyId and accessKeySecret before calling the token command.
3. Contact NocoBase support if your purchased tier should include private plugin registry access.

Example fix

// before
if (!keyData.accessKeyId || !keyData.accessKeySecret) { /* runtime throws */ }
// after
const hasCreds = typeof keyData.accessKeyId === 'string' && keyData.accessKeyId.length > 0 && typeof keyData.accessKeySecret === 'string' && keyData.accessKeySecret.length > 0;
if (!hasCreds) throw new Error('Re-activate license: key lacks registry credentials');

const keyData = /* parsed saved license key */;
if (!String(keyData.accessKeyId ?? '').trim() || !String(keyData.accessKeySecret ?? '').trim()) {
  console.error('Saved license key lacks package registry credentials; re-activate the license first.');
  process.exit(1);
}

function hasRegistryCredentials(k): k is LicenseKeyData & { accessKeyId: string; accessKeySecret: string } {
  return typeof k.accessKeyId === 'string' && k.accessKeyId.trim().length > 0 &&
         typeof k.accessKeySecret === 'string' && k.accessKeySecret.trim().length > 0;
}

try {
  const token = await token(runtime);
} catch (error) {
  if (/does not include package registry credentials/.test(String(error.message))) {
    console.error('Re-activate your license key to obtain registry credentials.');
  }
  throw error;
}

When it happens

Trigger: Calling `token` (which calls loginPkg) with a LicenseKeyData parsed from a key that has empty/missing accessKeyId or accessKeySecret fields.

Common situations: A license key issued for a tier or era without registry credentials; a corrupted/truncated key string; key pasted from an old export format.

Related errors

• Package registry login failed with status ${response.status}
• Package registry login did not return a token.
• Invalid license key format
• License key not match current environment
• (MissingSavedLicenseKeyError for env ${runtime.envName})

AI-assisted analysis of nocobase/nocobase@fa42722fef (2026-09-01). Data as JSON: /api/errors/0e3e2e1c127d287f. Report an issue: GitHub.