Vercel
Vercel managed npm credentials now let Sandbox install private packages using credentials held in a team’s Shared Environment Variables. The update also works with custom registries, including GitHub Packages and JFrog Artifactory.
According to the Vercel changelog, developers can switch the feature on when creating a sandbox. The required setting is credentials: { npm: true }.
How managed npm credentials work
The package token remains outside the sandbox. When the sandbox makes an installation request, Vercel’s firewall adds the authentication. The sandbox can therefore fetch a private dependency without receiving the underlying credential.
Teams manage those npm credentials through Shared Environment Variables. This gives existing projects a central place for the token rather than requiring each sandbox to receive its own copy.
- 1
Store the credentials
add the npm token to the team’s Shared Environment Variables
- 2
Enable npm access
pass `credentials: { npm: true }` when creating the sandbox
- 3
Install the dependency
run the package installation inside the sandbox
The same setup covers private packages hosted outside the standard npm registry. GitHub Packages and JFrog Artifactory are the two custom registry examples included in the update.
What builders need to change
Projects need the latest version of the Vercel Sandbox SDK or CLI before they can use managed npm credentials. Once updated, the credentials option is passed during sandbox creation.
The change is aimed at sandboxed jobs that must install private dependencies. That includes a sandbox working from project files that have been cloned or copied into its working directory. Authentication is applied to the installation request while the stored token stays outside that environment.
This separates package access from the code running inside the sandbox. It also means teams can use their existing shared npm credentials rather than supplying a token directly to each sandbox session.
Frequently asked questions
What are Vercel managed npm credentials?
Managed npm credentials let Sandbox install private npm packages using authentication stored in team Shared Environment Variables. Vercel’s firewall adds the authentication to installation requests, keeping the token outside the sandbox.
Which registries work with managed npm credentials?
The feature supports private npm packages and custom registries. Vercel specifically lists GitHub Packages and JFrog Artifactory.
Which Vercel plan includes managed npm credentials?
The announcement does not list pricing or plan requirements. It does state that users must update the Sandbox SDK or CLI to the latest version.
Sources
3 checkedHow we cover tool news: Create With's tool desk drafts these reports with AI from the sources listed above and checks them against those sources before publishing.
Granola
