Publishing to npm

Add OIDC to generators.yml

Add token: OIDC to the output section:

1
groups:
2
  ts-sdk:
3
	generators:
4
	  - name: fernapi/fern-typescript-sdk
5
		version: 3.12.0  # Must be 3.12.0 or later
6
		output:
7
		  location: npm
8
		  package-name: your-package-name
9
		  token: OIDC
10
	config:
11
	  namespaceExport: YourClientName
12
	github:
13
	  repository: your-org/your-repository
14
	  mode: push
15
	  branch: your-branch-name

Generate your SDK

Generate your SDK to create the GitHub Actions workflow with OIDC configuration:

$
fern generate --group ts-sdk

This creates a .github/workflows/ci.yml file that’s configured to use OIDC for npmjs publishing. Alternatively, you can push your generators.yml changes and let the Fern GitHub Action generate the workflow for you.

This creates a .github/workflows/ci.yml file that’s configured to use OIDC for npm publishing.

Authorize your repository on npmjs.com

Configure trusted publishing on npmjs.com to allow your GitHub repository to publish:

1. Navigate to your package settings on npmjs.com
2. Find the Trusted Publisher section and click Add trusted publisher
3. Select GitHub Actions as your provider
4. Fill in:
   • Organization or user: Your GitHub username or organization
   • Repository: Your TypeScript SDK repository name (e.g., your-org/your-repository)
   • Workflow filename: ci.yml
   • Environment name: Leave blank

For more details, see npm’s trusted publishing documentation.

Generate an npm token

1. Log into npmjs.com
2. Click on your profile picture and select Edit Profile
3. Select Access Tokens
4. Click Generate New Token and choose either Classic Token (select “Automation” type) or Granular Access Token
5. Save your token securely - it won’t be displayed again

Add token to generators.yml

Add token: ${NPM_TOKEN} to the output section:

1
groups:
2
  ts-sdk:
3
	generators:
4
	  - name: fernapi/fern-typescript-sdk
5
		version: 3.12.0
6
		output:
7
		  location: npm
8
		  package-name: your-package-name
9
		  token: ${NPM_TOKEN}
10
		config:
11
		  namespaceExport: YourClientName
12
		github:
13
		  repository: your-org/your-repository
14
		  mode: push
15
		  branch: your-branch-name

Add NPM_TOKEN as a GitHub Actions secret

1. Open your repository on GitHub and go to Settings
2. Navigate to Secrets and variables > Actions
3. Click New repository secret
4. Name it NPM_TOKEN and paste your npm token
5. Click Add secret

Configure trusted publishing on npmjs.com

Follow npm’s “Add a trusted publisher on npmjs.com” instructions:

1. Navigate to your package settings on npmjs.com
2. Find the Trusted Publisher section and click Add trusted publisher
3. Select GitHub Actions as your provider
4. Configure:
   • Organization or user: Your GitHub username or organization
   • Repository: Your TypeScript SDK repository name
   • Workflow filename: ci.yml (the default Fern workflow file)
   • Environment name: Leave blank (unless you use GitHub environments)

Update your generators.yml

Change the output.token field from ${NPM_TOKEN} to OIDC and ensure you’re using version 3.12.0 or later:

1
groups:
2
  ts-sdk:
3
	generators:
4
	  - name: fernapi/fern-typescript-sdk
5
		version: 3.12.0  # Must be 3.12.0 or later
6
		output:
7
		  location: npm
8
		  package-name: your-package-name
9
		  token: OIDC  # Changed from ${NPM_TOKEN}
10
	config:
11
	  namespaceExport: YourClientName
12
	github:
13
	  repository: your-org/your-repository

Regenerate your SDK

Regenerate your SDK with the updated CI configuration. You can do this either:

Locally:

$
fern generate --group ts-sdk

Or via GitHub Actions:

If you use the Fern GitHub Action to generate your SDK, simply push your updated generators.yml file and let the workflow regenerate the SDK for you.

This will update your .github/workflows/ci.yml file with the required OIDC permissions.

Remove the NPM_TOKEN secret

After verifying the migration works, remove the NPM_TOKEN secret from your GitHub repository settings to prevent accidental use.

Configure trusted publishing on npmjs.com

Follow the same instructions as Path 1 to add your repository as a trusted publisher on npmjs.com.

Update your CI workflow manually

Open your .github/workflows/ci.yml file and make these changes to the publish job:

1
publish:
2
  needs: [ compile, test ]
3
  if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
4
  runs-on: ubuntu-latest
5
  permissions:
6
	id-token: write  # ADD THIS: Required for OIDC
7
  steps:
8
	- name: Checkout repo
9
	  uses: actions/checkout@v4
10
11
	- name: Set up node
12
	  uses: actions/setup-node@v4
13
14
	# ADD THIS: Ensure npm 11.5.1 or later is installed for OIDC support
15
	- name: Update npm
16
	  run: npm install -g npm@latest
17
18
	- name: Install pnpm
19
	  uses: pnpm/action-setup@v4
20
21
	- name: Install dependencies
22
	  run: pnpm install
23
24
	- name: Build
25
	  run: pnpm build
26
27
	# MODIFY THIS: Remove npm config set and env block
28
	- name: Publish to npm
29
	  run: |
30
		if [[ ${GITHUB_REF} == *alpha* ]]; then
31
		  npm publish --access public --tag alpha
32
		elif [[ ${GITHUB_REF} == *beta* ]]; then
33
		  npm publish --access public --tag beta
34
		else
35
		  npm publish --access public
36
		fi
37
	  # Previously had:
38
	  # run: |
39
	  #   npm config set //registry.npmjs.org/:_authToken ${NPM_TOKEN}
40
	  #   if [[ ${GITHUB_REF} == *alpha* ]]; then
41
	  #     npm publish --access public --tag alpha
42
	  #   elif [[ ${GITHUB_REF} == *beta* ]]; then
43
	  #     npm publish --access public --tag beta
44
	  #   else
45
	  #     npm publish --access public
46
	  #   fi
47
	  # env:
48
	  #   NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

Key changes:

• Add permissions block with id-token: write to the publish job
• Add step to update npm to version 11.5.1 or later
• Remove the npm config set line from the publish step
• Remove the env block with NPM_TOKEN from the publish step

(Optional) Add ci.yml to .fernignore

If you haven’t already, add your CI workflow to .fernignore to prevent future generator updates from overwriting your manual changes:

.github/workflows/ci.yml

Remove the NPM_TOKEN secret

After verifying the migration works, remove the NPM_TOKEN secret from your GitHub repository settings.