Connect your npm project to Azure Artifacts
Azure DevOps Server 2019
Azure Artifacts enables developers to manage their packages from various sources, including both public registries like npmjs.com and private feeds. To authenticate with Azure Artifacts, you'll need to configure your npm config file. This file contains feed URLs and credentials used by npm, offering options to customize your npm client behavior, such as setting up proxies, defining default package locations, or configuring private package feeds. The .npmrc file is typically located in the user's home directory but can also be created at the project level to override default settings.
Prerequisites
An Azure DevOps organization. Create one for free.
An Azure DevOps project. Create a new project if you don't have one already.
An Azure Artifacts feed. Create one for free.
Connect to Feed
Azure Artifacts recommends using two separate configuration files. The first is dedicated to authenticating with Azure Artifacts, while the second should be kept locally to store your credentials. This approach allows you to share your configuration file while keeping your credentials secure.
To set up the second file, simply place it in your home directory on your development machine and include all your registry credentials. This enables the npm client to easily access your credentials for authentication.
The following steps will guide you through setting up the first configuration file. Select the tab that corresponds to your development environment:
Note
vsts-npm-auth is not supported in Azure DevOps Server.
Sign in to your Azure DevOps collection, and then navigate to your project.
Select Artifacts, and then select Connect to feed.
A new window will appear. From the left-hand navigation pane, select npm.
Follow the provided instructions to configure your project and user .npmrc files.
Tip
Using multiple registries in .npmrc files is supported with scopes and upstream sources.
Pipeline authentication
To authenticate with your pipeline, Azure Artifacts recommends using the npm authenticate task.
When using task runners such as gulp or Grunt, it's to prioritize setting your npm authenticate task at the beginning of your pipeline. This step guarantees that your credentials are injected into your project's .npmrc file and retained throughout the pipeline run, enabling subsequent steps to access the credentials in the configuration file.
Navigate to your project, select Pipelines > Builds, and then select your build definition.
Select Edit to modify your build pipeline.
Select
+to add a new task to your build pipeline.
Search for the npm Authenticate task, and then select Add.
Select your .npmrc file, and then select Save & queue when you're done.
Note
To access your feed from your pipeline, make sure that the build service role is set to Feed And Upstream Reader (Contributor) in your Feed settings > Permissions.
Note
If your organization is using a firewall or a proxy server, make sure you allow the appropriate domain URLs. See Allowed IP addresses and domain URLs for details.
Unable to publish
If you encounter a 403 error, it may indicate a name conflict. In Azure Artifacts, packages are immutable, meaning that once you publish a package to your feed, its version number is permanently reserved. Even if you delete it, you cannot publish a new package with the same version number. To address this issue, update the package version in your package.json file, and then try again.