Get started with npm packages in Azure Artifacts

Article
10/04/2022

Azure DevOps Services | Azure DevOps Server 2022 - Azure DevOps Server 2019 | TFS 2018

With Azure Artifacts, you can publish and download npm packages from feeds and public registries such as npmjs.com. This quickstart will guide you through creating your own feed, setting up your project, and publishing and downloading npm packages to and from your Azure Artifacts feed.

License the Azure Artifacts extension

To use Azure Artifacts in TFS, you must upgrade to Visual Studio Team Foundation Server 2017. If the Azure Artifacts extension has been removed, you can install it from the Visual Studio Marketplace.

Assign licenses in Team Foundation Server

Each organization gets five free licenses. If you need more than five licenses, go to the Visual Studio Marketplace, and select Get it free.

If you aren't sure, you can select Start 30-day free trial. Every user in your organization is then granted access to Azure Artifacts for 30 days. After the 30-day trial period, your organization reverts back to five entitled users, and you must assign licenses to individual users. If you need additional licenses at this point, you can purchase them from Visual Studio Marketplace. If you have a license for Visual Studio Enterprise, you already have access to Azure Artifacts and don't need to be assigned a license. Just ensure that you've been assigned the "Visual Studio Enterprise" access level.

Note

If you selected Start 30 day free trial and are still in the trial period, every user is granted access. Licenses don't need to be assigned until the trial period ends.

From any collection in Team Foundation Server, hover over the settings menu and select Users. Then select Package Management.
Select Assign, enter the users you want to assign licenses, and then select OK.
- Users with Visual Studio Enterprise subscriptions get Azure Artifacts for free. Make sure that your Visual Studio Enterprise subscribers have the appropriate access level. For more information, see Change access levels.
- Users who are using an instance of Team Foundation Server that's disconnected from the internet (and thus can't purchase licenses from Visual Studio Marketplace) can still assign licenses purchased through an enterprise agreement.

Create a feed

A feed is an organizational construct that allows users to store their packages and control who can access them. Azure Artifacts support storing several package types in a single feed such as NuGet, npm, Maven, Python, and Universal packages.

Select Artifacts, and then select Create Feed.
Give your feed a Name and choose its visibility (who can view packages in this feed), upstream sources, and scope (project-scoped or organization-scoped) settings.
Select Create when you're done.

Note

By default, the Project Collection Build Service (org-scoped) and the project-level Build Service (project-scoped) are set to Collaborator when you create a new feed.

Azure Artifacts comes pre-installed in TFS 2018. If this is the first time using your feed, you might be asked to assign a license

Go to Build & Release and select Packages.
Select + New feed.
Give your feed a Name, a Description, and set up who can read, who can contribute and if you want to Include external packages.
Select Create when you're done.

Set up your .npmrc files

Note

vsts-npm-auth is not supported in TFS and Azure DevOps Server.

We recommend having two .npmrc files. The first one should be placed in the same directory as your package.json file. The second one should be placed in the $home directory (Linux/macOS) or $env.HOME (Windows) to store your credentials. The npm client then will be able to look up this file and fetch your credentials for authentication. This enables you to share your config file while keeping your credentials secure.

Select Artifacts, and then select Connect to feed.
Select npm. If this is your first time using Azure Artifacts, select Get the tools and then follow the steps to download Node.js and set up the credential provider.
Follow the instructions in the Project setup to set up your project.

Set up authentication on your development machine

Important

npm supports a single registry in your .npmrc file. Multiple registries are possible with scopes and upstream sources.

Windows
Other

If you're developing on Windows, we recommend using vsts-npm-auth to authenticate with Azure Artifacts. Run npm install -g vsts-npm-auth to install the package globally and then add a run script to your package.json.

"scripts": {
    "refreshVSToken": "vsts-npm-auth -config .npmrc"
}

To authenticate with Azure Artifacts, we have to create a personal access token and add it to our .npmrc file.

Copy the following code snippet to your .npmrc file.

Organization-scoped feed:

; begin auth token
//pkgs.dev.azure.com/<ORGANIZATION_NAME>/_packaging/<FEED_NAME>/npm/registry/:username=[ENTER_ANY_VALUE_BUT_NOT_AN_EMPTY_STRING]
//pkgs.dev.azure.com/<ORGANIZATION_NAME>/_packaging/<FEED_NAME>/npm/registry/:_password=[BASE64_ENCODED_PERSONAL_ACCESS_TOKEN]
//pkgs.dev.azure.com/<ORGANIZATION_NAME>/_packaging/<FEED_NAME>/npm/registry/:email=npm requires email to be set but doesn't use the value
//pkgs.dev.azure.com/<ORGANIZATION_NAME>/_packaging/<FEED_NAME>/npm/:username=[ANY_VALUE_BUT_NOT_AN_EMPTY_STRING]
//pkgs.dev.azure.com/<ORGANIZATION_NAME>/_packaging/<FEED_NAME>/npm/:_password=[BASE64_ENCODED_PERSONAL_ACCESS_TOKEN]
//pkgs.dev.azure.com/<ORGANIZATION_NAME>/_packaging/<FEED_NAME>/npm/:email=npm requires email to be set but doesn't use the value
; end auth token

Project-scoped feed:

; begin auth token
//pkgs.dev.azure.com/<ORGANIZATION_NAME>/<PROJECT_NAME>/_packaging/<FEED_NAME>/npm/registry/:username=[ENTER_ANY_VALUE_BUT_NOT_AN_EMPTY_STRING]
//pkgs.dev.azure.com/<ORGANIZATION_NAME>/<PROJECT_NAME>/_packaging/<FEED_NAME>/npm/registry/:_password=[BASE64_ENCODED_PERSONAL_ACCESS_TOKEN]
//pkgs.dev.azure.com/<ORGANIZATION_NAME>/<PROJECT_NAME>/_packaging/<FEED_NAME>/npm/registry/:email=npm requires email to be set but doesn't use the value
//pkgs.dev.azure.com/<ORGANIZATION_NAME>/<PROJECT_NAME>/_packaging/<FEED_NAME>/npm/:username=[ENTER_ANY_VALUE_BUT_NOT_AN_EMPTY_STRING]
//pkgs.dev.azure.com/<ORGANIZATION_NAME>/<PROJECT_NAME>/_packaging/<FEED_NAME>/npm/:_password=[BASE64_ENCODED_PERSONAL_ACCESS_TOKEN]
//pkgs.dev.azure.com/<ORGANIZATION_NAME>/<PROJECT_NAME>/_packaging/<FEED_NAME>/npm/:email=npm requires email to be set but doesn't use the value
; end auth token

Generate a personal access token with packaging read and write scopes.

Encode your newly generated personal access token as follows:

Run the following command in an elevated command prompt window.

node -e "require('readline') .createInterface({input:process.stdin,output:process.stdout,historySize:0}) .question('PAT> ',p => { b64=Buffer.from(p.trim()).toString('base64');console.log(b64);process.exit(); })"

Paste your personal access token, and then press Enter.
Copy the Base64 encoded value.

Replace the [BASE64_ENCODED_PERSONAL_ACCESS_TOKEN] placeholder in your .npmrc file with your Base64 personal access token.

Connect to feed

Select Packages, and then select Connect to feed.
Select npm.
Select Generate npm credentials. Copy the credentials and add them to your .npmrc file.

Publish packages

To publish your npm package, run the following command in your project directory

npm publish

Important

Using the publishConfig property to override the registry config param at publish-time is not supported.

Restore packages

To restore an npm package, run the following command in your project directory

npm install --save <package>

Next steps

Publish npm packages (YAML/Classic) Use packages from npmjs.com Use npm scopes Use npm audit

Get started with npm packages in Azure Artifacts

License the Azure Artifacts extension

Assign licenses in Team Foundation Server

Create a feed

Set up your .npmrc files

Set up authentication on your development machine

Connect to feed

Publish packages

Restore packages

Next steps

Feedback

Additional resources

Additional resources