Get access
Browsing is public; pulling source and installing the CLI are not. Setup is one team membership and two scoped tokens - about five minutes, once per machine.
At a glance
github_pat_…Fine-grained PAT
Unlocks: Widget source from the registry
Loaded with: npx signalos token set
ghp_…Classic PAT · read:packages
Unlocks: The CLI from GitHub Packages
Loaded with: npm config set
Each token is scoped to exactly one job, so a leaked token exposes almost nothing. Both die the moment you leave the team.
1 - Join the consumers team
Ask your engineering lead to add you to the widget-consumers team in the SignalLabsAI GitHub organization. The team holds read access to the private signal-widgetsrepository - it's what both tokens authenticate against. Without membership, no token works.
2 - Create the registry token (fine-grained)
signalos-registry90 daysGenerate, copy the github_pat_…value - it's shown once. Two things that can bite: if SignalLabsAI isn't in the resource-owner dropdown, the org hasn't enabled fine-grained tokens (ask an org owner); if the org requires token approval, the token stays pending until an owner approves it.
3 - Create the CLI token (classic)
signalos-cli90 daysGenerate, copy the ghp_…value. This one is classic because GitHub Packages doesn't accept fine-grained tokens unless the org has explicitly enabled that support - and with a single scope, it can read packages and nothing else.
4 - Load both (once per machine)
# CLI token → user-level npm config npm config set //npm.pkg.github.com/:_authToken ghp_XXXX # registry token → shell env + project .env.local, then verified npx signalos token set github_pat_XXXX
In CI, skip both commands - set NODE_AUTH_TOKEN (CLI token) and SIGNALOS_REGISTRY_TOKEN (registry token) as Actions secrets instead.
Verify it works
npm whoami --registry=https://npm.pkg.github.com
# your GitHub username → CLI token OK
curl -s -o /dev/null -w "%{http_code}\n" \
-H "Authorization: Bearer $SIGNALOS_REGISTRY_TOKEN" \
https://raw.githubusercontent.com/SignalLabsAI/signal-widgets/main/r/index.json
# 200 → registry token OK. 404 → bad token or no team membership
# (GitHub answers 404, not 401, on private repos)Revocation
Removing someone from widget-consumers revokes their repository read permission immediately - every token they hold stops working for both the pull and the install. No keys to rotate, no registry to purge.