Install registry items from private GitHub repositories using the GitHub CLI or a token.

GitHub registries now work with private repositories.

In June, we made it possible to turn any public GitHub repository into a registry. Teams asked for the same thing for their internal code: design systems, feature kits, agent rules and conventions that should not be public.

You can now install from private repositories. If you can read the repository, the CLI can install from it.

Zero configuration

If you are logged in to the GitHub CLI, there is nothing to set up.

gh auth login

When a repository is not publicly readable, the CLI reads it through gh using your stored credentials. The token stays inside the GitHub CLI. It never enters the shadcn process.

✔ Using gh credentials.
✔ Checking registry.
✔ Created 1 file:
  - lib/auth.ts

CI support

Where the GitHub CLI is not installed, set GH_TOKEN or GITHUB_TOKEN:

GH_TOKEN=github_pat_xxx npx shadcn@latest add acme/internal-toolkit/auth-kit

We recommend a fine-grained personal access token scoped to the repository with Contents: Read-only access.

Works with every command

Private repositories work with the same commands as public GitHub registries.

How it works

• Public repositories are read anonymously, exactly as before. No credentials are used and the GitHub CLI is never invoked.
• The CLI tries anonymous access first and only uses your credentials when the repository is not publicly readable.
• Private files are read through GitHub's Contents API, pinned to the resolved commit SHA.
• A token from GH_TOKEN is only ever sent to api.github.com. Stored GitHub CLI credentials are read by gh, not by the CLI.

See the Private repositories docs for the full guide.