# Get access The SDK is a private package. Here is how to get your npm token and install it. `@avatarfactory/react` and `@avatarfactory/react-native` are **private packages**. They live on the public npm registry under a restricted scope, so `npm install` without credentials will fail — that is expected, not a broken setup. Your npm token comes with your plan. Once you have it, everything else about using the SDK is completely normal: same install command, same imports, same API. > Being private changes exactly one thing — you authenticate to npm once. It does > not change the code you write. Every example in these docs works as written. ## Setup ### Step 1 — Get your token Choose a plan and your read-only npm token is issued with it. Keep it somewhere safe — it grants install access to the package. ### Step 2 — Create a .npmrc file Add a `.npmrc` at the root of your project, next to `package.json`. Point the `@avatarfactory` scope at the registry and supply your token: ```ini @avatarfactory:registry=https://registry.npmjs.org/ //registry.npmjs.org/:_authToken=${AVATARFACTORY_NPM_TOKEN} ``` Then put the token itself in your environment, not in the file: ```bash export AVATARFACTORY_NPM_TOKEN=your_token_here ``` ### Step 3 — Install as usual ```bash npm install @avatarfactory/react @rive-app/react-webgl2 ``` From here, follow the [Quickstart](/docs/quickstart) — nothing else differs. > **Do not commit a literal token.** The `${AVATARFACTORY_NPM_TOKEN}` form above is > expanded by npm at install time, so the `.npmrc` is safe to commit while the > secret stays in your environment. If you paste the raw token into the file > instead, add `.npmrc` to `.gitignore`. ## CI and deployment Your build machine needs the same token. Set `AVATARFACTORY_NPM_TOKEN` as a secret in your CI or hosting provider and commit the `.npmrc` above — the scoped form works unchanged on Vercel, Netlify, GitHub Actions, and Docker builds. ## When install fails > A **404** on `@avatarfactory/react` almost always means npm never saw your token, > not that the package is missing. Check that `.npmrc` sits at the project root, > that `AVATARFACTORY_NPM_TOKEN` is actually set in the shell running the install, > and that your scope line points at `registry.npmjs.org`. A **403** means the > token was seen but is not valid for this package — check it has not expired. ## Building with an AI coding agent If you are handing this documentation to Claude Code, Cursor, or Codex, the agent can implement the entire integration from these docs whether or not it can install the package. See [Build with an AI agent](/docs/agents).