Summary
Vercel's v0 can now install private npm and custom-registry packages using credentials stored as shared environment variables (NPM_TOKEN or NPM_RC), letting teams build in v0 with their existing design systems, component libraries, and internal packages. Credentials can be marked sensitive and are never exposed to the model or written to the sandbox filesystem.
What changed
v0 can now install private packages from npm and custom registries using credentials stored as shared environment variables (NPM_TOKEN for registry.npmjs.org, NPM_RC for scoped or multiple registries such as GitHub Packages or JFrog Artifactory); credentials can be marked sensitive and are never exposed to the model or written to the sandbox filesystem.
Why it matters
AI app builders are only useful in real organizations if they can work with proprietary internal packages, not just public ones. Wiring private-registry auth into v0 — while keeping credentials out of the model context and sandbox filesystem — closes a common enterprise-adoption blocker, letting AI-generated apps depend on a company's own component libraries from the first build without leaking secrets.
Evidence excerpt
v0 now installs private packages from npm and custom registries using credentials stored as shared environment variables on Vercel.