How do I use private dependencies with Vercel?

The Vercel platform allows you to install private dependencies in your project by assigning public or private repositories formatted as npm packages in your package.json file dependencies.

Private npm Dependencies

You can reference public or private repositories formatted as npm packages in your package.json file dependencies. Private repository modules require a special link syntax that varies by Git provider.

For GitHub, create a GitHub personal access token with read-only access, and include it in the package URL as follows:

"package-name": "git+https://<github_token>:x-oauth-basic@github.com/<user>/<repo>.git"

You can keep access tokens private by storing them as Environment Variables in your project's settings.

For GitHub Enterprise Server, create a GitHub personal access token with read-only access, and include it in the package URL as follows:

"package-name": "git+https://<github_token>:x-oauth-basic@<self-hosted-instance.url>/<user>/<repo>.git"

For GitLab, create a GitLab deploy token with read_repository access, and include it in the package URL as follows:

"package-name": "git+https://<token-username>:<token>@gitlab.com/<user>/<repo>.git"

For GitLab self-managed, create a GitLab deploy token with read_repository access, and include it in the package URL as follows:

"package-name": "git+https://<token-username>:<token>@<self-hosted-instance.url>/<user>/<repo>.git"

For Bitbucket, create a Bitbucket app password with read-only access, and include it in the package URL as follows:

"package-name": "git+https://<user>:<app-password>@bitbucket.org/<user>/<repo>.git"

Other Package Registries

To use private packages from registries other than npm, add the contents of your .npmrc file as an Environment Variable to your project from the Vercel dashboard. This can be found by selecting the project, and viewing the general tab under the project settings.

Select the desired Environments and add the key NPM_RC with the contents of your .npmrc file as the Value. Since this file typically has newlines, it might be easier to use the CLI:

$ vc env add NPM_RC [environment] < ~/.npmrc

Also note that Vercel Runtimes are installed from the canonical npm registry so registry.npmjs.org must be one of the lines in your .npmrc file:

//registry.npmjs.org/:_authToken=TOKEN_FOR_NPM //npm.pkg.github.com/:_authToken=TOKEN_FOR_GITHUB

Example of a .npmrc file.

How this Works

At build time, Vercel will dynamically create a .npmrc file and then install your dependencies from package.json.

This allows you access to private packages without having to commit your own .npmrc file to source control.

Updated February 11th 2022