Failed to replace env in config

Verify latest release

I verified that the issue exists in the latest pnpm release

pnpm version

No response

Which area(s) of pnpm are affected? (leave empty if unsure)

No response

Link to the code that reproduces this issue or a replay of the bug

No response

Reproduction steps

Create a simple nuxt 3 repo (^3.7.0)
Create an .npmrc file

Add the following

@fortawesome:registry = https://npm.fontawesome.com/
//npm.fontawesome.com/:_authToken = ${FONTAWESOME_NPM_AUTH_TOKEN}

Create an .env file

Add the following

FONTAWESOME_NPM_AUTH_TOKEN=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

Install fontawesome pro packages pnpm i @fortawesome/pro-duotone-svg-icons

Describe the Bug

When trying to install the packages, I'm getting the following warning.

Issue while reading "path\to\.npmrc". Failed to replace env in config: ${FONTAWESOME_NPM_AUTH_TOKEN}

Expected Behavior

According to the docs, it should read the variable properly.

Which Node.js version are you using?

16.20.2

Which operating systems have you used?

macOS
Windows
Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

No response

Hi, this error occurs because pnpm does not automatically load environment variables from the .env file into process.env.

set FONTAWESOME_NPM_AUTH_TOKEN =xxxx && pnpm i should work on windows ~

export the env variable defined in .env and source it will work.

.env

export NPM_AUTH_TOKEN=token

Run:

source .env.local # load the env variables

pnpm i

how long will the env variable be persisted for? until computer restart, new terminal window, some kind of cache clear, etc?

Since other pm's have that feature we should change that to a feature request "Support loading .env files on execution". Especially in enterprise this is common to not have tokens in config files on employee desktops.

@muuvmuuv

Second to @muuvmuuv

I'm having the same issue on Fedora 41 w/ Zsh.

echo $FONTAWESOME_NPM_TOKEN returns the key.

The content of my .npmrc is:

@fortawesome:registry=https://npm.fontawesome.com/
//npm.fontawesome.com/:_authToken=${FONTAWESOME_NPM_TOKEN}

Also tried using _username and _password but it doesn't matter, the env variables are not injected in the .npmrc file.

This is what I get when I run pnpm config list:

 WARN  Issue while reading "/path/to/local/repo/.npmrc". Failed to replace env in config: ${FONTAWESOME_NPM_TOKEN}
//registry.npmjs.org/:_authToken=npm_.............
__source__=project
registry=https://registry.npmjs.org/
user-agent=pnpm/9.13.2 npm/? node/v22.11.0 linux x64

Versions:

Node 22.11.0
PNPM 9.13.2

Come on guys!

I did not know about this feature of npm CLI. Do you know where this is documented on their website? Or in Yarn's docs if they also support this.

I tried it locally with npm CLI. It doesn't seem to take the variables from .env

@zkochan

@zkochan, take a look here.

https://docs.npmjs.com/cli/v9/configuring-npm/npmrc/

I don't see any mention of a .env file on that page.

I don't see any mention of a .env file on that page.

You're right, there's no mention about that.

I think they are 2 different issues:

A feature request: use .env* files to load environment variables (which at this point isn't NPM-compliant).
A bug(?): PNPM doesn't use the actual environment variables as expected, even when they're already loaded in the shell context (as I commented before).

A bug(?): PNPM doesn't use the actual environment variables as expected, even when they're already loaded in the shell context (as I #7111 (comment)).

I don't know how to reproduce that. It seems to work for me. This code is replacing env variables in settings:

https://github.com/pnpm/npm-conf/blob/e4bd72ee83bf7c95bb2ca0d702e808bd1d763836/lib/util.js#L58

We even added support for default values like:

//npm.fontawesome.com/:_authToken=${FONTAWESOME_NPM_TOKEN:00000000111111111}

@zkochan

@zkochan PNPM seems to be working as expected here. .env files are not supported by NPM though Yarn added .env support about a year and a half ago (yarnpkg/berry#4718 / https://yarnpkg.com/configuration/yarnrc#injectEnvironmentFiles).

I'd be curious though, is there another way of separating out secrets in .npmrc from the non-secret configuration information stored inside it? In my case, I use .npmrc to store both the NPM_TOKEN and PNPM configurations e.g. publish-branch. I would prefer to be able to check-in the .npmrc file since it has non-secret configuration settings but I can't since it contains the NPM_TOKEN. Ideally, I'd be able to place an env file like .env or .env.pnpm (to avoid conflicts) that I can git-ignore and properly version the .npmrc.

Example:

.npmrc

//registry.npmjs.org/:_authToken=${NPM_TOKEN}

# Prevents publish from any branch other than main
publish-branch=main
# Ensures we use locally linked packages when available
link-workspace-packages=true
# Defaults to saving as workspace:*
save-workspace-protocol=rolling

.env.pnpm

NPM_TOKEN=secret_auth_token_here

FWIW this is indeed not working for me either (locally):

//npm.fontawesome.com/:_authToken = ${FONTAWESOME_NPM_AUTH_TOKEN}

But this is working (see the removed curly braces):

//npm.fontawesome.com/:_authToken = $FONTAWESOME_NPM_AUTH_TOKEN

However, it does work locally (Mac OS Sequoia), but it works in reverse in GitHub Workflows... So locally I have my .npmrc set to $FONTAWESOME_NPM_AUTH_TOKEN, but on GitHub CI, I manually recreate the .npmrc with ${FONTAWESOME_NPM_AUTH_TOKEN} 😢

This makes sense to me:

unset FONTAWESOME_NPM_AUTH_TOKEN
pnpm install
WARN … Failed to replace env in config …

pnpm can't fully resolve the .npmrc to install dependencies.

But once those dependencies are resolved, this seems odd to me:

unset FONTAWESOME_NPM_AUTH_TOKEN
pnpm build
WARN … Failed to replace env in config …

The dependencies are already there, so why is this a problem?

running into similar warnings, and i cant figure out how to get this to work consistently, in both ci cd and in local

So what's the solution to this now?

Switching pm, use monorepo tools, built somethign around. Or make the key visible like AI would vibe code 😄 i did the last because of private/company repos.

@zkochan

@zkochan any thoughts on a pnpm global/project-level config to allow loading .env files if they exist before executing commands like pnpm i? I understand there are workarounds but it'd be nice if I just need to setup my .env, run pnpm i and then it just works.

See https://yarnpkg.com/configuration/yarnrc#injectEnvironmentFiles which does this IIUC.

+1 this would be highly useful

Closing: current pnpm covers this.

pnpm expands ${VAR} in an npmrc from the environment; it does not read a .env file. Export the variable, or let the tool that reads .env start pnpm.

If you still hit this on the latest pnpm, please comment with a reproduction and we will reopen.

Written by an agent (Claude Code, claude-opus-5).

feat(pacquet): load dotenv files named by --env-file (#16570)

Update pnpm to v12.16.1 (#2164)

Navigation Menu

Repository navigation

Failed to replace env in config #7111

Verify latest release

pnpm version

Which area(s) of pnpm are affected? (leave empty if unsure)

Link to the code that reproduces this issue or a replay of the bug

Reproduction steps

Describe the Bug

Expected Behavior

Which Node.js version are you using?

Which operating systems have you used?

If your OS is a Linux based, which one it is? (Include the version if relevant)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Failed to replace env in config #7111

Description

Verify latest release

pnpm version

Which area(s) of pnpm are affected? (leave empty if unsure)

Link to the code that reproduces this issue or a replay of the bug

Reproduction steps

Describe the Bug

Expected Behavior

Which Node.js version are you using?

Which operating systems have you used?

If your OS is a Linux based, which one it is? (Include the version if relevant)

Activity

await-ovo commented on Sep 20, 2023

await-ovo commented on Sep 21, 2023

JunlinPan-Crypto commented on Dec 1, 2023

alycda commented on Jan 16, 2024

muuvmuuv commented on Jun 19, 2024

KBeDevel commented on Nov 15, 2024

b8zeek commented on Nov 16, 2024

zkochan commented on Nov 16, 2024

b8zeek commented on Nov 17, 2024

zkochan commented on Nov 17, 2024

KBeDevel commented on Nov 18, 2024

zkochan commented on Nov 18, 2024

kingston commented on Jan 10, 2025

aversini commented on Jan 20, 2025

jamesarosen commented on May 28, 2025

sudo-vaibhav commented on Jul 4, 2025

lockinmarv commented on Nov 4, 2025

muuvmuuv commented on Nov 4, 2025

runofthemillgeek commented on Nov 10, 2025

sudo-vaibhav commented on Nov 10, 2025

zkochan commented on Sep 19, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions