Use npm scopes

VSTS | TFS 2018 | TFS 2017

Scopes are built into npm and are a way of grouping packages together. In VSTS and in, you can publish and use both scoped and unscoped packages.

Scopes are also the npm client's only native affordance to use multiple registries/feeds. They allow you to separate your private packages from packages by prefixing your packages with a @scope: e.g. @fabrikam/fiber-core and configuring your .npmrc file to only use a Package Management feed for that @scope.

Set up

To use a Package Management feed with a scope, follow the instructions below, but append your scope to both lines in the project .npmrc file.

For Linux or Mac users, the Connect to feed dialog will generate an appropriately-formatted token that you can place into your .npmrc file with a lifespan of 90 days.

If you want to create a token that lasts longer than 90 days, skip to the second method below.

90-day token:

  1. From the Packages hub, select Connect to feed

  2. Select npm.

  3. Click Generate npm credentials and copy them to add them to your user .npmrc manually:

    Connect to feed from VSTS Package Management Linux/Mac credentials

Create a token that lasts longer than 90 days:

  1. Navigate to security and generate a PAT with a narrow scope of "Packaging (read and write)".
  2. Base64 encode the PAT. On Windows you can use...

  3. In your $home/.npmrc add the following lines replacing account, feedname, username, PAT, and email.


Then, replace:

  • registry=<your feed URL> with
  • @fabrikam:registry=<your feed URL>

Upstreams or scopes?

Scopes add an additional restriction when naming your packages: each package name must start with @<scope>. If you're ok with this limitation, and don't intend to ever publish your private packages to, scopes are an alternative to upstream sources.

If you do intend to publish private packages to, we recommend not using scopes unless you intend to publish your packages to with the scope intact; if you remove the scope when transitioning the package from Package Management to, you'll need to update any package.json references accordingly.