Quick answer
npm documents token and scope counts as 1,000 tokens/account; 50 orgs and 50 packages/scopes per token. A token can select packages, scopes, or a combination within the documented count.
Verified Aug 22, 2026Official source
Current limits
| Constraint | Current value | Scope | Verified source |
|---|---|---|---|
| token and scope countsA token can select packages, scopes, or a combination within the documented count. | 1,000 tokens/account; 50 orgs and 50 packages/scopes per token | Granular access tokens | npmAug 22, 2026 |
Why does this limit matter?
A single over-broad CI token is unnecessary and can still hit target-count limits in a large organization.
This value is scoped to Granular access tokens; a different plan, runtime, model, endpoint, region, or account can produce a different effective constraint.
What should you check?
- Inventory CI targets and create narrowly scoped, expiring tokens or trusted publishing.
- Confirm the exact plan, model, runtime, endpoint, region, and account that serve the failing workload.
- Record the observed value, response headers or configuration, timestamp, and source without logging secrets.
Important caveats
- Token permissions cannot exceed the creating user's current permissions.
- Treat the official source and live account configuration as authoritative if they differ from this verified snapshot.
HyperObserve reports the documented platform constraint. Your application, SDK, gateway, provider, region, or account can impose a lower effective limit.
Related