Install self-hosted Claspine from Claspine Packages

Words you’ll see

License key

The SPINE-FOUNDER-… or SPINE-AGENCY-… code that identifies your self-hosted license. Quote it when you contact support. It is not a password and cannot download anything by itself.

Download token

A secret starting with spk_ that lets your builds download Claspine’s packages. It works like a password for Maven and npm: keep it in an environment variable or a CI secret, never in your code.

Package registry

A server that hands out code libraries to build tools. Maven (Java) and npm (JavaScript) download the libraries your project lists from registries. Claspine Packages is Claspine’s private one, at api.claspine.com/packages.

Update period

The year after you buy (or renew) during which you receive every new Claspine release. Versions released in that year stay yours to install forever, even after it ends.

Before you start

• A Claspine account (free): sign in at console.claspine.com.
• A Java project built with Maven or Gradle, a web project using npm, pnpm or yarn, or both.

Steps

1. Click a buy button on claspine.com (or open console.claspine.com/self-hosted), sign in or create a free account, choose Founder or Agency and pay. Your license appears in the Self-hosted area of the console as soon as the payment is confirmed.
2. Under the license click New token and name it after where it will be used, for example My laptop or Acme - CI. The token is shown once: copy it straight away. Make one token per place you build, so you can revoke one without touching the others.
3. Save the token as the environment variable SPINE_PACKAGES_TOKEN on that computer, or as a secret with the same name in that CI (for example GitHub Actions → Settings → Secrets).
4. Copy the snippets from Self-hosted → Setup in the console (also below) into your Maven settings and pom.xml, your Gradle build, and the .npmrc next to your package.json.
5. Add the Claspine packages you need, for example com.grahmur:grahmur-platform-backend (Java) or @grahmur-org/claspine-client (web), with the version you want, and build as usual.

<!-- ~/.m2/settings.xml -->
<settings><servers><server>
  <id>spine-packages</id>
  <username>license</username>
  <password>${env.SPINE_PACKAGES_TOKEN}</password>
</server></servers></settings>

<!-- pom.xml -->
<repositories><repository>
  <id>spine-packages</id>
  <url>https://api.claspine.com/packages/maven</url>
</repository></repositories>

# .npmrc
@grahmur-org:registry=https://api.claspine.com/packages/npm/
//api.claspine.com/packages/npm/:_authToken=${SPINE_PACKAGES_TOKEN}

What goes where in Claspine

Keep it safe

• Treat the download token like a password. Never put it in source code, screenshots or chat messages.
• If a token may have leaked, revoke it under Self-hosted → Licenses and create a new one for that place. Your other tokens keep working.
• Colleagues can help manage licenses: invite them under Self-hosted → Team. They use their own Claspine sign-in, never your token.
• Pin exact versions in your build. Upgrades then happen when you choose, not when a new release appears.

Claspine stores the values encrypted, never shows them again in full, and never sends them to your app or SDK.

If something goes wrong

Maven or npm says 401 Unauthorized.

The token is missing or wrong. Check that <code>SPINE_PACKAGES_TOKEN</code> is set in the shell or CI job that runs the build, and that the token was not revoked (the Licenses page lists every token and when it was last used).

A version is “not found”, but older ones work.

That version was released after your update period ended. Renew on the Licenses page to receive it and every release for another year.

npm still downloads @grahmur-org packages from npmjs.com.

The .npmrc must sit next to the package.json you install from, and the first line must end with a slash: <code>/packages/npm/</code>.

Provider documentation

• Maven: settings reference
• npm: .npmrc

← All setup guides