BYTETOOLS

npm Registry API

Free npm registry API with no key: package metadata, all versions, dependencies, maintainers and dist-tags for any public package. Tested curl example.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-19

What is the npm Registry API?

The npm Registry API is a free, key-free API that returns metadata for any public npm package — every published version, dependencies, maintainers, licence, repository and dist-tags such as latest.

Every npm package has a public JSON document at `https://registry.npmjs.org/<package>`, and it is completely open. This is the same endpoint npm itself uses, so the data is authoritative rather than a mirror.

Be aware that the full document is large — it contains the complete metadata for every version ever published, which for a mature package can run to several megabytes. When you only need the current release, request `/<package>/latest` instead and save the bandwidth.

Quick facts

Base URL
https://registry.npmjs.org
Authentication
No key for public package reads. Publishing requires an auth token.
Rate limit
No published hard limit, but the registry is a shared resource — cache rather than polling.
Pricing
Free.
CORS
Enabled — callable directly from browser JavaScript
Official docs
Read the docs

How to use the npm Registry API

Every request below was executed against the live API on 2026-08-19, and the response shown is the real body it returned — not an illustration.

1. Fetch metadata for a package

GET https://registry.npmjs.org/next

curl
curl 'https://registry.npmjs.org/next'
JavaScript (fetch)
const res = await fetch("https://registry.npmjs.org/next");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);
Python (requests)
import requests

res = requests.get("https://registry.npmjs.org/next", timeout=20)
res.raise_for_status()
print(res.json())
Response — HTTP 200
{"_id":"next","_rev":"4194-34202ed7bb15900c788103265667bbb3","name":"next","dist-tags":{"next-11":"11.1.4","next-12-2-6":"12.2.6","next-14-1":"14.1.1","rc":"15.0.0-rc.1","next-13":"13.5.11","next-12-3-2":"12.3.7","beta":"16.0.0-beta.0","next-14":"14.2.35","next-15-3":"15.3.9","next-15-2":"15.2.9","next-15-0":"15.1.12","next-15-0-0":"15.0.8","preview":"16.3.0-preview.10","backport":"15.5.23","lates

Parameters

ParameterTypeRequiredDescription
<package>pathRequiredPackage name. Scoped names must be URL-encoded, e.g. %40scope%2Fname. next
<version>pathOptionalA specific version, or `latest` for just the current release. latest

Response fields

name / descriptionstring
Package name and description.
dist-tags.lateststring
Current latest published version — usually the field you actually want.
versionsobject
Every published version keyed by version number. This is what makes the document large.
timeobject
Publish timestamp for each version, plus created and modified.
license / repositorystring|object
Licence identifier and source repository.

What you can build with the npm Registry API

  • Show the current version of a package in documentation automatically
  • Check whether a dependency has a newer release
  • Audit licences across your dependency tree
  • Build package search, comparison or badge services

Common errors and how to fix them

404

Package does not exist, or a scoped name was not URL-encoded.

Fix: Encode scoped packages: `@scope/name` becomes `%40scope%2Fname`.

Very large response

You fetched the full document with every version.

Fix: Request `/<package>/latest` when you only need the current release.

npm Registry API — frequently asked questions

Does the npm registry API need authentication?

No, reading public package metadata is completely open with no key. Authentication is only needed to publish packages or access private ones.

How do I get just the latest version of an npm package?

Request `https://registry.npmjs.org/<package>/latest`, which returns only the current release rather than the full multi-megabyte document containing every version.

How do I query a scoped package?

URL-encode the name — `@angular/core` becomes `%40angular%2Fcore`. Sending the raw slash returns a 404.

Can I get npm download statistics from this API?

No, downloads come from a separate host, api.npmjs.org/downloads, which exposes point and range endpoints for package download counts.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

JSON Validator

Free online JSON validator: validate JSON and find syntax errors with the exact line and column. See root type, key counts and depth — instant and 100% private.

npm Registry API is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-19; always check the official documentation before relying on this API in production, as terms and limits can change.