Azure Artifacts · npm · Checked November 6, 2026

Azure Artifacts: npm "E401 Unable to authenticate, need: Bearer authorization_uri=…"

When npm asks an Azure Artifacts feed for a package without a credential the feed accepts, the feed answers 401 and lists the ways it would take one: a Bearer token, Basic with a personal access token, or TFS-Federated. npm prints that list. It almost never means the feed is down; it means npm sent nothing usable for that address (a Stack Overflow question on this message has been seen over 170,000 times).

When npm install fails in a pull request's build validation, the pull request waits on it: Azure DevOps Pull Requests, a plugin for JetBrains IDEs, lists the pull request's branch policies with their state in your IDE, and with Pro runs a failed build policy again once the feed lets the build in. Get it on JetBrains Marketplace

What it looks like

• npm ERR! code E401, then npm ERR! Unable to authenticate, need: Bearer authorization_uri=https://login.windows.net/<tenant>, Basic realm="https://pkgsprodcus1.pkgs.visualstudio.com/", TFS-Federated. The realm changes with the region. Newer npm writes npm error instead of npm ERR!.
• Another form: Unable to authenticate, your authentication token seems to be invalid. npm did send a token, and the feed refused it.

npm matches credentials by address

• The project's .npmrc has the registry= line. The credentials go in lines that start with the same address without https:, such as //pkgs.dev.azure.com/fabrikam/_packaging/shared/npm/registry/:_password=, and npm uses them only for requests to that address. Microsoft's snippet has two sets, one ending in /npm/registry/ and one in /npm/ (Microsoft's npm setup page).
• The same feed also answers at its old address, https://fabrikam.pkgs.visualstudio.com/_packaging/shared/npm/registry/. A registry line on one address and credentials on the other do not match, and npm sends nothing (an answer on the most read question). Check every .npmrc in the repository and in your home folder, and use one address everywhere; another answer found the two mixed across several files.
• A project-scoped feed has the project in the address (/fabrikam/Web/_packaging/shared/), and the credential lines need it too.
• Keep the credentials in your user-level .npmrc (in your home folder), and only the registry= line in the project's, which is committed. That is how Microsoft sets it up.

Windows: vsts-npm-auth

• vsts-npm-auth -config .npmrc reads the registry from the project's .npmrc and writes a token into your user-level one. Microsoft notes the token expires, npm then gets 401, and the fix is to run the command again.
• If it ends at once without asking you to sign in, it is keeping a token it already has, which may be the bad one (for example after a password change). vsts-npm-auth -config .npmrc -force gets a new one: the most voted answer on the most read question, with over 200 votes.
• vsts-npm-auth does not work with Azure DevOps Server. There, use a personal access token as below.

macOS, Linux, or no vsts-npm-auth: a personal access token

• Create a personal access token with the Packaging, Read & write scope. In the user-level .npmrc, for each of the two address forms, set :username= to any value that is not empty, :_password= to the token encoded in base64, and :email= to anything, because npm requires it and does not use it (Microsoft's npm setup page).
• npm decodes _password from base64, so a token pasted in as it is reaches the feed garbled and is refused. Encode it without a newline at the end: echo -n "token" | base64, not echo alone. When the token expires, the same 401 comes back; make a new one and encode it again.

In a pipeline: npmAuthenticate before npm install

• Add - task: npmAuthenticate@0 with workingFile: set to the project's .npmrc (the file, not its folder), before npm ci, npm install or npm publish. It finds the registries in that file and adds credentials for them at the end of it: the build's own for feeds in your organization, and those of an npm service connection named in customEndpoint for any other registry (the task's reference). The file is put back as it was when the run ends.
• It adds credentials to one .npmrc at a time. With several projects, run it once per file, or, as the reference shows, authenticate one .npmrc in $(Agent.TempDirectory) and point NPM_CONFIG_USERCONFIG at it.
• With the task in place and still E401 or 403, the build identity has no role on the feed, or the feed is in another project with Limit job authorization scope on. The roles and that setting are the same as for NuGet: Unable to load the service index for source. A package that comes through an upstream source such as npmjs needs Feed and Upstream Reader (Collaborator) the first time.

Azure DevOps pull requests in IntelliJ IDEA and Rider

Azure DevOps Pull Requests, a plugin by Lesstep for JetBrains IDEs 2024.1 or later and Android Studio, reads the organization, project and repository from your git remote and lists the pull requests that wait for your review in an IDE tool window, on Azure DevOps Services and on Azure DevOps Server. It shows the branch policies of a pull request with their state, so a required build that has not passed is next to its pull request, and with Pro you run a failed or expired build policy again from there. The review inbox is free; voting, commenting, completing and creating are Pro, with a 30-day trial.

Get it on JetBrains Marketplace

Azure DevOps, Azure Artifacts and Azure Pipelines are trademarks of Microsoft Corporation; npm is a trademark of npm, Inc.; IntelliJ IDEA and Rider are trademarks of JetBrains s.r.o. This page is not affiliated with or endorsed by Microsoft, npm, Inc. or JetBrains.

More: pip: 401 Error, Credentials not correct for · NuGet: Unable to load the service index for source · checkout stops with Git fetch failed with exit code: 128 · VS800075: the build service cannot see the project · 日本語