Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Temporary workaround: publish VS Code extensions with an organization-scoped PAT

Open
  • Is something wrong?
#10,526 0 comments 1 reaction 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
45/100
Issue type
Documentation
Clarity
Clearly specified
Activity status
Active
Tech stack
markdown
Domain
documentation

Research direction

The issue provides the complete temporary workaround and says it should remain separate from the publishing docs; no target file or test is named. Read the linked discussion in microsoft/vscode-docs#10519 and the documentation work in #10517 to understand the placement decision and long-term guidance. Done means recording or maintaining this workaround separately without presenting PAT-based publishing as the recommended long-term approach.

Written by the indexing model from the issue text.

Description

doc-enhancement

Context

Azure DevOps is retiring global personal access tokens (PATs) on December 1, 2026. These are the tokens created with Organization: All accessible organizations, as described in the existing VS Code extension publishing instructions. Publishers who use a global PAT need to replace it to continue publishing.

Important: An organization-scoped PAT can serve as a temporary workaround. PAT-based publishing is not the recommended long-term approach. This issue records the workaround separately from the publishing docs, in line with Lynn Dai's guidance.

Temporary workaround

  1. Sign in to the Azure DevOps portal with the same Microsoft account that has publishing access to your Marketplace publisher.

  2. Select any Azure DevOps organization you belong to. If you do not belong to one, create an organization.

    Marketplace publishers are not linked to Azure DevOps organizations. The organization is needed to create the PAT; it does not need to correspond to your Marketplace publisher. Marketplace authorizes the account that owns the token, so that account must have access to publish for your publisher.

  3. Open User settings > Personal access tokens, then select New Token.

  4. Configure the token:

    • Name: enter a descriptive name.
    • Organization: select a specific organization you belong to, not All accessible organizations.
    • Expiration: choose an appropriate expiration date.
    • Scopes: select Custom defined, then Show all scopes. Under Marketplace, select Manage.

  5. Select Create and store the token securely. Do not share it in this issue or commit it to source control.

  6. Verify access without publishing an extension:

    npx @vscode/vsce verify-pat <publisher-id> -p <PAT>

    Replace <publisher-id> with your Marketplace publisher ID and <PAT> with the new organization-scoped token.

    Security caution: Passing a token on the command line can expose it in shell history or process arguments. Run this only in a trusted environment and do not share terminal output containing credentials.

  7. Use the new token in place of the global PAT in your existing publishing workflow. For an interactive workflow, run vsce login <publisher-id> and enter the new token when prompted. For automation, update the stored publishing secret.

If verification returns 401 Unauthorized or 403 Forbidden, check that the PAT has Marketplace > Manage scope and that the account that created it has publishing access to the specified publisher.

Long-term direction

Trusted Publishing enables publishing without a PAT and is the intended long-term direction. See the documentation work in microsoft/vscode-docs#10517 and follow the published guidance once it is available. This issue does not promise a release date or continued long-term support for PAT-based publishing.

Related discussion:

  • microsoft/vsmarketplace#2121: global PAT retirement and extension publishing.
  • microsoft/vscode-docs#10519: proposed organization-scoped PAT instructions and the decision to keep this temporary workaround out of the docs.
Dominant language
Markdown
Stars
6.7k
Forks
5.8k
Avg merge
12h 41m
Merged PRs (30d)
140

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/vscode-docs

All issues in microsoft/vscode-docs

Similar issues

More Documentation issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.