I'm working with Heroku, Node and GitHub.

I've created a PAT (Personal Access Token) in GitHub. And I would like to use it to install a private repository on GitHub.

The Node package.json file has a reference to the repository and I'm currently using HTTPS as the protocol.

For example, the private remote GitHub repo I want to install is: https://myname:token@github.com/myname/project.git.

However GitHub has revoked usage of the token, because it was viewable in my Git commit.


Heroku doesn't provide this out of the box, and package.json doesn't natively support environment variables.

One option is to build your dependency as an NPM packages and publish it on a private package repository, e.g. Gemfury, whose Heroku addon has a free plan supporting a single private module.

Briefly, you can publish your module to Gemfury with https://npm-proxy.fury.io/APPID/, followed by npm login and npm publish. Then, in the Heroku app that depends on your private module, add a .npmrc file containing


and set a Heroku config var FURY_AUTH containing your Gemfury auth token.

This does mean you'll have to update your published library on Gemfury before the dependent application will see changes you make to it. This is probably a good idea anyway; depending on specific tagged releases is safer than depending on mutable branches.

There is also this workaround which may let you effectively inject environment variables into your package.json, but I haven't tried it.

To add to this answer

1) Create environment variables link.

2) Write environment variables into package.json file using a preinstall hook link.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.