Hey,

You can start from here: https://vercel.com/guides/using-private-dependencies-with-vercel

Hi Swarnava,

I see that it's possible to authenticate using the GitHub Personal Access token embedded in the URL of the dependency, however the official GitHub docs say:

"Treat your access tokens like passwords"

One of the big security no-nos is to commit sensitive tokens to git history, so it seems inappropriate to put the token in the package.json as plaintext. This leads me to see two options for which I'd like your input:

• Option 1:
  • Somehow inject the sensitive token into the dependency's URL via Vercel Environment Variables, or
• Option 2:
  • Somehow get the Vercel build agent to use the same credentials for cloning accessing the private dependency as it does to clone the main project's repo

Option 1

As per the linked earlier discussion, using an Environment Variable to dynamically inject into the dependency's URL definition would look something like this:

1{2  "dependencies": {3    "my-package": "https://{{ process.env.GITHUB_TOKEN }}@github.com/homer-simpson/electric-hammer"4  }

Is there a way to make that happen without resorting to a custom buildCommand that manually modifies the file after cloning?

Option 2

If the dependency is hosted in a private repo that has identical user access requirements to the Project repo, Vercel should/could be able to continue using the existing credentials in the shell session to authenticate access to the dependency's repo.

How could I make this happen? I see that there's a .git directory at the beginning of the build step, but I cannot determine what authentication credentials are present on disk or in memory at the time of build. Is it an SSH key? A one-time token? A machine-to-machine oauth grant?

Please help me understand which options I have here, as I'm following the official npm package.json specifications and would expect the platform to be compatible.

Thank you for your help.