Using bun install with an Azure Artifacts npm registry

Azure Artifacts is a package management system for Azure DevOps. You can use it to host your own private npm registry, along with other types of packages.

Configure with bunfig.toml

To use Azure Artifacts with bun install, add a bunfig.toml file to your project with the following contents. Replace my-azure-devops-org with the name of your Azure DevOps organization and my-feed with the name of your feed. If the feed is project-scoped, the URL also includes the project name: https://pkgs.dev.azure.com/my-azure-devops-org/my-project/_packaging/my-feed/npm/registry/. The username can be any non-empty string.

[install.registry]
url = "https://pkgs.dev.azure.com/my-azure-devops-org/_packaging/my-feed/npm/registry/"
username = "my-azure-artifacts-user"
# You can use an environment variable here
password = "$NPM_PASSWORD"

Then assign your Azure Personal Access Token to the NPM_PASSWORD environment variable. Bun automatically reads .env files, so create a file called .env in your project root. Don’t base64 encode the token; Bun does that for you.

NPM_PASSWORD=<paste token here>

Configure with environment variables

To configure Azure Artifacts without bunfig.toml, set the NPM_CONFIG_REGISTRY environment variable. Append :username=<USERNAME> and :_password=<PASSWORD> to the URL, as shown below. Replace <USERNAME> and <PASSWORD> with your own values.

NPM_CONFIG_REGISTRY=https://pkgs.dev.azure.com/my-azure-devops-org/_packaging/my-feed/npm/registry/:username=<USERNAME>:_password=<PASSWORD>

Don’t base64 encode the password

Azure Artifacts’ instructions for .npmrc say to base64 encode the password. Do not do this in bunfig.toml or NPM_CONFIG_REGISTRY; Bun base64 encodes the password for you. Bun also reads .npmrc files, and there _password must stay base64 encoded, as in Azure’s instructions.

To decode a base64-encoded password, open your browser console and run:

atob("<base64-encoded password>");

Alternatively, use the base64 command line tool, though the password may end up in your shell history:

echo "base64-encoded-password" | base64 --decode