How to Integrate Replit with JFrog Artifactory

Artifactory uses token-based authentication for programmatic access. You need to generate a deploy token (also called an access token) that your Replit project will use when installing or publishing packages. Log into your Artifactory instance. Navigate to Administration → User Management → Access Tokens (in JFrog Platform, this may be under your username → Edit Profile → Generate API Key or Identity and Access → Access Tokens). Create a new token with the following settings: - Token type: Access Token (not reference token) - Username: your Artifactory username or a service account name - Scope: Applied permissions for the specific repositories you need to access. For read-only package installation, select 'Read' on the target virtual repository. For publishing, add 'Write' permission. - Expiry: Set an appropriate expiry. For development tokens that rotate with the project, 1 year is common. For CI/CD, consider shorter-lived tokens. Copy the generated token immediately — it is shown only once. Also note your Artifactory instance URL (e.g., https://yourcompany.jfrog.io) and the repository names you will use (e.g., npm-virtual for npm packages, pypi-virtual for Python packages). The full registry URL for npm is typically https://yourcompany.jfrog.io/artifactory/api/npm/npm-virtual/.

Click the lock icon (🔒) in the Replit sidebar to open the Secrets pane. Add the following secrets for your Artifactory integration: ARTIFACTORY_URL: your Artifactory instance base URL, e.g., https://yourcompany.jfrog.io. ARTIFACTORY_TOKEN: the deploy token you generated in Step 1. ARTIFACTORY_NPM_REGISTRY: the full npm registry URL, e.g., https://yourcompany.jfrog.io/artifactory/api/npm/npm-virtual/. ARTIFACTORY_PYPI_INDEX: the pip index URL, e.g., https://yourcompany.jfrog.io/artifactory/api/pypi/pypi-virtual/simple. These secrets are accessed in configuration files and scripts using shell-style environment variable substitution. You will reference them in the .npmrc and pip.conf files in the next steps. Replit exposes Secrets as environment variables in the Shell and in running processes, so configuration files that use ${ARTIFACTORY_TOKEN} syntax will have the value substituted at runtime.

1# Check that Artifactory secrets are configured
2import os
3
4required = ['ARTIFACTORY_URL', 'ARTIFACTORY_TOKEN']
5for key in required:
6    val = os.environ.get(key)
7    if not val:
8        print(f'MISSING: {key} — add it in Replit Secrets (lock icon 🔒)')
9    else:
10        print(f'OK: {key} = {val[:30]}...')

Create a .npmrc file in the root of your Replit project to configure npm to use Artifactory as the package registry. This file tells npm where to find packages and how to authenticate. The .npmrc file supports environment variable substitution using the ${VARIABLE_NAME} syntax, which is how you reference your Artifactory credentials without hardcoding them. There are two registration patterns: scoped registry (for specific package scopes like @your-company/*) and global registry override (replacing the default npm registry entirely with Artifactory). Use scoped for corporate packages alongside public packages; use global override if Artifactory is a proxy that includes all public packages. After creating .npmrc, test it by running npm install in the Replit Shell. If authentication succeeds, packages will be fetched from Artifactory. If you see 401 errors, verify ARTIFACTORY_TOKEN is set correctly in Secrets. Note: .npmrc should be committed to your repository if it uses environment variable references (${ARTIFACTORY_TOKEN}) — the secrets themselves are never in the file, only the references. If for any reason you use a plaintext token in .npmrc (not recommended), add .npmrc to .gitignore.

1# .npmrc — Configure npm to use Artifactory registry in Replit
2# For scoped packages only (@your-company/* scope)
3@your-company:registry=https://yourcompany.jfrog.io/artifactory/api/npm/npm-virtual/
4//yourcompany.jfrog.io/artifactory/api/npm/npm-virtual/:_authToken=${ARTIFACTORY_TOKEN}
5
6# OR: Global registry override (replace all npm with Artifactory)
7# registry=https://yourcompany.jfrog.io/artifactory/api/npm/npm-virtual/
8# //yourcompany.jfrog.io/artifactory/api/npm/npm-virtual/:_authToken=${ARTIFACTORY_TOKEN}
9
10# For publishing packages back to Artifactory
11# publishConfig:
12#   registry=https://yourcompany.jfrog.io/artifactory/api/npm/npm-local/
13
14# Optional: set email and always-auth for strict environments
15# email=your-service-account@yourcompany.com
16# always-auth=true

For Python Replit projects, configure pip to use Artifactory as the package index. Create a pip.conf file (or set pip configuration via environment variables) that points to your Artifactory PyPI virtual repository. The simplest approach in Replit is to set the PIP_INDEX_URL environment variable in your .replit configuration file or shell startup, pointing to your Artifactory PyPI URL with credentials embedded. Alternatively, create a pip.conf file in the project root. Artifactory's PyPI repository URL includes your credentials using the format: https://username:token@yourcompany.jfrog.io/artifactory/api/pypi/pypi-virtual/simple/. However, embedding credentials in URLs is less secure than using .netrc or pip's --extra-index-url with environment variables. The recommended approach for Replit is to use the PIP_EXTRA_INDEX_URL or PIP_INDEX_URL environment variable with credentials, referencing your Replit Secret via the standard ${ARTIFACTORY_TOKEN} pattern in the .replit file's environment section. After configuration, test with pip install your-private-package in the Replit Shell. pip should fetch the package from Artifactory's PyPI repository.

1# pip.conf — Configure pip to use Artifactory PyPI in Replit
2# Place this file at the project root or at ~/.config/pip/pip.conf
3
4[global]
5# Replace the default PyPI with Artifactory virtual repo (which proxies public PyPI)
6index-url = https://yourcompany.jfrog.io/artifactory/api/pypi/pypi-virtual/simple/
7
8# Authentication via trusted host (use _authToken in the URL for token auth)
9# For token auth, embed in URL:
10# index-url = https://<username>:${ARTIFACTORY_TOKEN}@yourcompany.jfrog.io/artifactory/api/pypi/pypi-virtual/simple/
11
12trusted-host = yourcompany.jfrog.io
13
14# --- Alternative: set via environment in .replit ---
15# Set in Shell or .replit env section:
16# PIP_INDEX_URL=https://username:${ARTIFACTORY_TOKEN}@yourcompany.jfrog.io/artifactory/api/pypi/pypi-virtual/simple/
17
18# --- Install a private package: ---
19# pip install your-internal-library
20# pip install -r requirements.txt  (all packages fetched from Artifactory)