Publishing to npm

Add OIDC to generators.yml

Add token: OIDC to the output section:

1
groups:
2
  ts-sdk:
3
	generators:
4
	  - name: fernapi/fern-typescript-sdk
5
		version: 3.69.0  # Must be 3.12.3 or later
6
		output:
7
		  location: npm
8
		  package-name: your-package-name
9
		  token: OIDC
10
	config:
11
	  namespaceExport: YourClientName
12
	github:
13
	  repository: your-org/your-repository
14
	  mode: push
15
	  branch: your-branch-name

Generate your SDK

Generate your SDK to create the GitHub Actions workflow with OIDC configuration:

$
fern generate --group ts-sdk

This creates a .github/workflows/ci.yml file that’s configured to use OIDC for npmjs publishing. Alternatively, you can push your generators.yml changes and let the Fern GitHub Action generate the workflow for you.

This creates a .github/workflows/ci.yml file that’s configured to use OIDC for npm publishing.

Authorize your repository on npmjs.com

Configure trusted publishing on npmjs.com to allow your GitHub repository to publish:

1. Navigate to your package settings on npmjs.com
2. Find the Trusted Publisher section and click Add trusted publisher
3. Select GitHub Actions as your provider
4. Fill in:
   • Organization or user: Your GitHub username or organization
   • Repository: Your TypeScript SDK repository name (e.g., your-org/your-repository)
   • Workflow filename: ci.yml
   • Environment name: Leave blank

For more details, see npm’s trusted publishing documentation.

Generate an npm token

1. Log into npmjs.com
2. Click on your profile picture and select Edit Profile
3. Select Access Tokens
4. Click Generate New Token and choose either Classic Token (select “Automation” type) or Granular Access Token
5. Save your token securely - it won’t be displayed again

Add token to generators.yml

Add token: ${NPM_TOKEN} to the output section:

1
groups:
2
  ts-sdk:
3
	generators:
4
	  - name: fernapi/fern-typescript-sdk
5
		version: 3.69.0
6
		output:
7
		  location: npm
8
		  package-name: your-package-name
9
		  token: ${NPM_TOKEN}
10
		config:
11
		  namespaceExport: YourClientName
12
		github:
13
		  repository: your-org/your-repository
14
		  mode: push
15
		  branch: your-branch-name

Add NPM_TOKEN as a GitHub Actions secret

1. Open your repository on GitHub and go to Settings
2. Navigate to Secrets and variables > Actions
3. Click New repository secret
4. Name it NPM_TOKEN and paste your npm token
5. Click Add secret

Configure trusted publishing on npmjs.com

Follow npm’s “Add a trusted publisher on npmjs.com” instructions:

1. Navigate to your package settings on npmjs.com
2. Find the Trusted Publisher section and click Add trusted publisher
3. Select GitHub Actions as your provider
4. Configure:
   • Organization or user: Your GitHub username or organization
   • Repository: Your TypeScript SDK repository name
   • Workflow filename: ci.yml (the default Fern workflow file)
   • Environment name: Leave blank (unless you use GitHub environments)

Update your generators.yml

Change the output.token field from ${NPM_TOKEN} to OIDC and ensure you’re using version 3.12.3 or later:

1
groups:
2
  ts-sdk:
3
	generators:
4
	  - name: fernapi/fern-typescript-sdk
5
		version: 3.69.0  # Must be 3.12.3 or later
6
		output:
7
		  location: npm
8
		  package-name: your-package-name
9
		  token: OIDC  # Changed from ${NPM_TOKEN}
10
	config:
11
	  namespaceExport: YourClientName
12
	github:
13
	  repository: your-org/your-repository

Regenerate your SDK

Regenerate your SDK with the updated CI configuration. You can do this either:

Locally:

$
fern generate --group ts-sdk

Or via GitHub Actions:

If you use the Fern GitHub Action to generate your SDK, simply push your updated generators.yml file and let the workflow regenerate the SDK for you.

This will update your .github/workflows/ci.yml file with the required OIDC permissions.

Remove the NPM_TOKEN secret

After verifying the migration works, remove the NPM_TOKEN secret from your GitHub repository settings to prevent accidental use.

Configure trusted publishing on npmjs.com

Follow the same instructions as Path 1 to add your repository as a trusted publisher on npmjs.com.

Update your CI workflow manually

Open your .github/workflows/ci.yml file and make these changes to the publish job:

1
publish:
2
  needs: [ compile, test ]
3
  if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
4
  runs-on: ubuntu-latest
5
  permissions:
6
	contents: read   # ADD THIS: Required for actions/checkout@v4
7
	id-token: write  # ADD THIS: Required for OIDC
8
  steps:
9
	- name: Checkout repo
10
	  uses: actions/checkout@v4
11
12
	- name: Set up node
13
	  uses: actions/setup-node@v4
14
15
	# ADD THIS: Ensure npm 11.5.1 or later is installed for OIDC support
16
	- name: Update npm
17
	  run: npm install -g npm@latest
18
19
	- name: Install pnpm
20
	  uses: pnpm/action-setup@v4
21
22
	- name: Install dependencies
23
	  run: pnpm install
24
25
	- name: Build
26
	  run: pnpm build
27
28
	# MODIFY THIS: Remove npm config set and env block
29
	- name: Publish to npm
30
	  run: |
31
		if [[ ${GITHUB_REF} == *alpha* ]]; then
32
		  npm publish --access public --tag alpha
33
		elif [[ ${GITHUB_REF} == *beta* ]]; then
34
		  npm publish --access public --tag beta
35
		else
36
		  npm publish --access public
37
		fi
38
	  # Previously had:
39
	  # run: |
40
	  #   npm config set //registry.npmjs.org/:_authToken ${NPM_TOKEN}
41
	  #   if [[ ${GITHUB_REF} == *alpha* ]]; then
42
	  #     npm publish --access public --tag alpha
43
	  #   elif [[ ${GITHUB_REF} == *beta* ]]; then
44
	  #     npm publish --access public --tag beta
45
	  #   else
46
	  #     npm publish --access public
47
	  #   fi
48
	  # env:
49
	  #   NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

Key changes:

• Add permissions block with id-token: write and contents: read to the publish job
• Add step to update npm to version 11.5.1 or later
• Remove the npm config set line from the publish step
• Remove the env block with NPM_TOKEN from the publish step

(Optional) Add ci.yml to .fernignore

If you haven’t already, add your CI workflow to .fernignore to prevent future generator updates from overwriting your manual changes:

.github/workflows/ci.yml

Remove the NPM_TOKEN secret

After verifying the migration works, remove the NPM_TOKEN secret from your GitHub repository settings.