Authenticating to feeds with NuGet

Last Update: 2/23/2017

Team Services | TFS 2017

All feeds in Package Management in Team Services and TFS require authentication. You need to store credentials for the feed before you can install or publish packages. How you authenticate depends on your choice of client (Visual Studio or NuGet.exe) and the version of that client.

The Package Management service prefers NuGet 3.x+ clients: they're faster, provide more features, and are regularly updated by the NuGet team. However, Package Management also supports NuGet 2.x clients.

For a complete list of the latest clients, see the NuGet distribution page.

Package Management feeds work seamlessly with the NuGet Package Manager for Visual Studio 2015 extension as of Visual Studio 2015 Update 1. If you haven't installed Update 1 or later, you can update to the latest version of the NuGet Package Manager extension directly. Using Visual Studio for Mac? See this guidance.

  1. NuGet Package Manager works with Visual Studio 2015 Update 1 and later
  2. NuGet Credential Provider works with NuGet.exe 3.3+
  3. Personal Access Tokens work with all supported NuGet clients and are a great way to get started quickly
  4. Mac OS users should use the personal access tokens flow with Visual Studio for Mac
  5. NuGet Auth Helper works with all supported NuGet clients and is best for use in integrated engineering environments
  6. .NET Core currently requires plain-text credentials

Note: this page covers interactive authentication. For help using feeds in builds, see the builds section.

NuGet Package Manager

Works with Visual Studio 2015 and later

Usage instructions

  1. Download the latest NuGet Package Manager extension.
  2. Add the feed as a package source.

If you added an account to Visual Studio that has access to the feed, the Package Manager will use the account to authenticate. Otherwise, Visual Studio prompts you for credentials and stores the encrypted credentials for subsequent operations.

NuGet Credential Provider

Works with NuGet.exe 3.3+

NuGet 3.3 added support for Credential Providers. The NuGet Credential Provider automatically acquires and refreshes credentials for feeds and is the recommended auth flow for NuGet 3.x users.

Usage instructions

Navigate to your feed (or create a feed if you haven't). Then, select Connect to feed:

Connect to feed button in the upper-right of the page

Next, copy the NuGet package source URL:

NuGet Package source URL in the Connect to feed dialog

For advanced scenarios, install the credential provider

By default, the credential provider works alongside NuGet.exe.

For advanced scenarios, you can choose where to install the provider:

  • Projects with a developer command prompt or enlistment: Use the provider from an environment variable by copying CredentialProvider.Vss.exe to any folder, then run this command in PowerShell: $env:NUGET_CREDENTIALPROVIDERS_PATH = {your folder}
  • Projects using a non-Team Services CI server: Use the provider from an environment variable
  • Work on an individual machine: Install the provider globally by copying CredentialProvider.Vss.exe to $env:LOCALAPPDATA\NuGet\CredentialProviders

Bootstrap into your workflow

You can also add the provider to your enlistment or developer command prompt using our bootstrap tools. This is recommended if you're using the provider in a multi-engineer development environment.

Download the credential provider directly

You can download the credential provider directly from this link: https://{account}.pkgs.visualstudio.com/_apis/public/nuget/client/CredentialProviderBundle.zip

Personal Access Tokens

Works with most NuGet clients, including Visual Studio for Mac

For NuGet clients that aren't supported by any of the above authentication methods, you can get a Personal Access Token (or alternate credentials) and use it at interactive auth prompts or for Basic authentication.

Note: Personal Access Tokens do not work for domain users working with NuGet feeds on TFS.

Usage instructions

First, generate a Personal Access Token (PAT) using the instructions here. We strongly recommend not checking your PAT into source control; anyone with access to your PAT can interact with Team Services as you. We also recommend scoping your PAT to the account(s) you want to access and to one of the following scopes: Packaging (read), Packaging (read and write), or Packaging (read, write, and manage).

  1. Navigate to your feed. If you haven't created a feed, create one now.
  2. Select Connect to feed.
  3. Copy the NuGet package source URL.
  4. If you're using a 2.x version of NuGet, make sure to alter the package source URL using these instructions.
  5. Run nuget.exe sources add -name {your feed name} -source {your feed URL} -username {anything} -password {your PAT}

Visual Studio for Mac

If you're using Visual Studio for Mac, follow the first 3 instructions above. Then:

  1. Open the Preferences dialog from the Visual Studio menu in the menu bar.
  2. Select NuGet -> Sources.
  3. Click Add then enter your feed's name, URL, any username, and your PAT as the password.
  4. Click OK, then OK again.

Visual Studio for Mac preferences window with VSTS feed added

NuGet Auth Helper

Works with all versions of Visual Studio and NuGet.exe

The NuGet Auth Helper acquires credentials for each of the package sources in a NuGet.config file and stores the encrypted credentials in %AppData%\NuGet\NuGet.config. Because the acquired credentials are Personal Access Tokens, which periodically expire, you'll sometimes need to re-run the helper to update your credentials.

Usage instructions

  1. Download a bundle with the latest version of NuGet.exe and the NuGet Auth Helper: https://{account}.pkgs.visualstudio.com/_apis/public/nuget/client/AuthHelperBundle.zip
  2. Add your feed as a NuGet package source
    • To add a feed to the global NuGet.config: nuget sources add -name {your feed name} -source {your feed URL}
    • To add a feed to your solution, create or edit a NuGet.config file at the solution root
  3. Run the helper on your your NuGet.config file: VSS.NuGet.AuthHelper.exe -Config {path/to/NuGet.config}
    • The path to the global NuGet.config is $env:APPDATA\NuGet\NuGet.config

Bootstrap into your workflow

You can also add the helper to your enlistment or developer command prompt using our bootstrap tools.

This is recommended if you're using the helper in a developer team that cannot update to NuGet 3.x and Visual Studio 2015 Update 1.

.NET Core

.NET Core's dotnet restore command doesn't currently support encrypted credentials. To use VSTS NuGet feeds with dotnet restore, you'll need to specify a Personal Access Token in plain text.

Note that as of NuGet 3.4.0, the nuget restore command can be used in place of the dotnet restore command. nuget restore works with any of the auth mechanisms outlined on this page.

Usage instructions

First, generate a Personal Access Token (PAT) using the instructions here. We strongly recommend not checking your PAT into source control; anyone with access to your PAT can interact with Team Services as you. We also recommend scoping your PAT to the account(s) you want to access and to one of the following scopes: Packaging (read), Packaging (read and write), or Packaging (read, write, and manage).

  1. Create or edit a NuGet.config at the solution root, next to the project.json file
  2. Add your VSTS feed(s) to your solution by running nuget.exe sources add -name {feed name} -source {feed URL} -username {username} -password {PAT} -StorePasswordInClearText
  3. Each developer on your team should repeat the previous two steps on their machines