Why does my .npmrc work when the _auth value is hardcoded but not when it uses an env var?

Question

I have the following .npmrc in my home directory (~/.npmrc):

registry=https://my-domain.jfrog.io/artifactory/api/npm/my-source/
//my-domain.jfrog.io/artifactory/api/npm/my-source/:email = ${MY_EMAIL}
//my-domain.jfrog.io/artifactory/api/npm/my-source/:_auth = ${MY_BASIC_AUTH}
//my-domain.jfrog.io/artifactory/api/npm/my-source/:always-auth = true

I also have my .zshenv file (~/.zshenv):

export MY_EMAIL="[email protected]"
export MY_AUTH_TOKEN="somebase64value"
export MY_BASIC_AUTH="anotherbase64value"

When I try to install something from my local registry, I get a HTTP 401: HttpErrorAuthUnknown: Unable to authenticate, need: Basic realm="Artifactory Realm"

However, when I replace ${MY_BASIC_AUTH} in my .npmrc with the actual value it should resolve to it works fine and I am able to download the package. The env vars are exported and are reachable from the node REPL.

I am using npm version 9.6.7 and node version 18.17.1. I am on a Mac as well (Ventura 13.5).

Any ideas why the env var approach isn't working but the hardcoded version is? When I replace the value, I just copy and paste it between the .zshenv to the .npmrc so I know they are the same value.

EDIT: When running an npm config ls -l the environment variable for the email is resolved and the auth says protected. So then when I swap the email env var for the basic auth env var it is resolved and is the same value as the one I copy. So I know the variables are resolving.