# How to limit access to npm registry by scope

**URL:** <https://community.sonatype.com/t/how-to-limit-access-to-npm-registry-by-scope/8337>\
**Category:** Sonatype Nexus Repository\
**Tags:** npm, authentication\
**Created:** [March 4, 2022, 12:17pm UTC](https://community.sonatype.com/t/how-to-limit-access-to-npm-registry-by-scope/8337 "2022-03-04T12:17:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ronny.gallin](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/ronny.gallin/32/2206_2.png) [@ronny.gallin](https://community.sonatype.com/u/ronny.gallin)\
**Post date:** [March 4, 2022, 12:17pm UTC](https://community.sonatype.com/t/how-to-limit-access-to-npm-registry-by-scope/8337/1 "2022-03-04T12:17:20Z")

</div>

Hi everybody,  
I am currently evaluating the nexus pro X features. I am looking for a possibility to limit the users access to a group by [npm scope](https://docs.npmjs.com/cli/v8/using-npm/scope).  
Is there a chance to implement my feature?

Thanks in advance.  
Regards

---

<div class="post-metadata">

**Author:** ![dsawa](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/dsawa/32/729_2.png) [@dsawa](https://community.sonatype.com/u/dsawa)\
**Post date:** [March 4, 2022, 1:24pm UTC](https://community.sonatype.com/t/how-to-limit-access-to-npm-registry-by-scope/8337/2 "2022-03-04T13:24:16Z")

</div>

Hi Ronny,  
Yes, you can use [Content Selectors](https://help.sonatype.com/repomanager3/nexus-repository-administration/access-control/content-selectors) to achieve that, for example you could create a content selector like `format == "npm" and path =^ "/@my-scope/"`. to match everything within `@my-scope`.

---

<div class="post-metadata">

**Author:** ![mmartz](https://avatars.discourse-cdn.com/v4/letter/m/e9bcb4/32.png) [@mmartz](https://community.sonatype.com/u/mmartz)\
**Post date:** [March 4, 2022, 3:09pm UTC](https://community.sonatype.com/t/how-to-limit-access-to-npm-registry-by-scope/8337/3 "2022-03-04T15:09:02Z")

</div>

Do be careful with content selectors as over-using them can cause performance issues. If it makes sense in your case, you might consider using separate repositories so that you can use repository-level permissions.

---

<div class="post-metadata">

**Author:** ![marckleser81](https://avatars.discourse-cdn.com/v4/letter/m/e0b2c6/32.png) [@marckleser81](https://community.sonatype.com/u/marckleser81)\
**Post date:** [March 8, 2022, 11:46am UTC](https://community.sonatype.com/t/how-to-limit-access-to-npm-registry-by-scope/8337/4 "2022-03-08T11:46:39Z")

</div>

> [@dsawa](#):
>
> Hi Ronny,  
> Yes, you can use [Content Selectors](https://help.sonatype.com/repomanager3/nexus-repository-administration/access-control/content-selectors?_ga=2.155664763.198472945.1646737669-1175897930.1646737669) [Zaun](https://www.sichtschutz-direkt.de/) to achieve that, for example you could create a content selector like `format == "npm" and path =^ "/@my-scope/"`. to match everything within `@my-scope`.

Thank you for you help. That worked for me!