Vendure Platform packages live at https://registry.vendure.io. Your project sends a Registry Access Token on every install, and Console issues that token against one Project.
You do not copy it by hand. npx @vendure-platform/create and vendure console link both ask Console for one and write the project .npmrc themselves.
The Project Link Manifest records which Console issued the link. After you link through staging, later link
repairs and status checks use staging without VENDURE_CONSOLE_APP_URL or VENDURE_CONSOLE_API_URL. Set both
variables only for the first scaffold or link. An explicit pair that conflicts with the manifest is refused.
Sign in with your Vendure Console account to read this documentation.