Search code examples
node.jsaccess-tokenazure-keyvault.npmrc

How to use Azure Key Vault in npmrc file?

I have a secret personal access token (only for building purposes) in my .npmrc file. As this secret is exposed, I thought of replacing this using Azure Key Vault. I haven't found any documentation around it. When I created the personal token before, I had given it only packaging/building access. How can I achieve this, please help me with this? Or is there any better way to include the personal access token in the .npmrc file?

Solution

  • Since you confirmed you are using Azure DevOps for your build, you don't need to maintain PAT in the .npmrc file. Just keep your npm registry URL there (I assume the private npm registry is also in the Azure DevOps) like below:

    registry={your npm registry URL}

always-auth=false

    Now, in the build pipeline, add npm Authenticate task before npm install.

    - task: npmAuthenticate@0
  inputs:
    workingFile: <relative path to your .npmrc file>