Netlify: TipTap Pro Authentication Issue

[NG4Dev]

The Problem

We're trying to use TipTap Pro extensions (specifically extension-export-docx and extension-import-docx) in our Next.js application. While
everything works perfectly on our local development machines, we cannot get the packages to install on Netlify's build servers. We
consistently get a "403 Forbidden" error when trying to fetch the TipTap Pro packages during the build process.

Our Setup

We're building a Next.js application on Netlify's build platform. We have a valid TipTap Pro authentication token that's 64 characters long . This token is stored as an environment variable called TIPTAP_PRO_AUTH_TOKEN in Netlify's
environment settings.

What Happens During the Build

When Netlify tries to build our project, we can see from the logs that:

1. Our authentication setup script runs successfully
2. It finds the token from the environment variable (confirms it's 64 characters)
3. It creates the .npmrc file with the correct registry URL and authentication token
4. The .npmrc file contents show the proper format with the TipTap Pro registry pointing to registry.tiptap.dev
5. But when Yarn tries to fetch the packages, it immediately gets a 403 Forbidden error

What We've Verified

• The token exists and is being read correctly (we see "Token found (64 characters)" in the logs)
• The .npmrc file is being created with the right format
• The registry URL is correct (https://registry.tiptap.dev/)
• The authentication token is being included in the .npmrc file
• The same setup works on local machines with the same token

Solutions We've Attempted

1. Direct .npmrc creation - We created a script that runs before package installation to create the .npmrc file with the authentication token.
   The file gets created successfully but authentication still fails.
2. Multiple authentication file formats - We tried creating .npmrc, .yarnrc, and .yarnrc.yml files to cover different package manager
   versions. All files were created successfully but authentication still failed.
3. Switching from Yarn to NPM - Since Netlify uses Yarn version 1.22.22 by default, and Yarn 1.x has known issues with scoped registry
   authentication, we tried forcing NPM instead. However, Netlify kept defaulting back to Yarn despite our configuration changes.
4. Different token formats - We tried various authentication formats including with and without the "always-auth" flag. None worked.
5. Environment variable verification - We confirmed the token is accessible and has no extra spaces or line breaks that might cause issues.

The Specific Error

Every attempt results in the exact same error when Yarn tries to fetch the package:

• It attempts to download from: https://registry.tiptap.dev/@tiptap-pro%2fextension-export-docx/-/extension-export-docx-1.0.0-beta.6.tgz
• It immediately receives: "Request failed 403 Forbidden"

Environment Details

• Build platform: Netlify
• Package manager: Yarn 1.22.22 (automatically used by Netlify)
• Node version: 20.19.5
• Build image: Ubuntu Focal 20.04

What We Suspect

Since the authentication setup appears correct and the token is being read properly, we believe either:

1. The token doesn't have the correct permissions for package downloads (though it works locally)
2. There's something specific about how Yarn 1.x sends authentication to your registry that's different from NPM or newer Yarn versions
3. There might be IP-based restrictions or something specific about Netlify's build servers that's causing the authentication to be rejected

The Question for TipTap Support

Given that our authentication setup appears correct (token is found, .npmrc is created with proper format, registry URL is correct), why would
we still receive 403 Forbidden errors? Is there something special about authentication from CI/CD environments or with Yarn 1.x that we need
to configure differently? The token works perfectly on local machines but fails consistently on Netlify's build servers.