Where we list / Listing guides
How to publish an extension to the VS Code Marketplace
You create a publisher on the Visual Studio Marketplace management page, package your extension with the vsce command line tool, and run vsce publish or upload the .vsix file by hand. Microsoft's docs mention no publishing fee. Every package is scanned for malware and secrets before it becomes public; no review time is published.
Checked on VS Code Marketplace's own pages on 2026-11-12.
| Cost | No publishing fee is mentioned. Listings can carry a Free or Trial pricing label. |
|---|---|
| Who can submit | Anyone who creates a publisher and can authenticate, by a Personal Access Token from an Azure DevOps organization or by federated identity from GitHub Actions or Azure Pipelines. |
| Review | Automated: malware scanning with several antivirus engines, a sandboxed run, and secret scanning. The extension is not public until the scan is clear. Verified publisher requests take up to 5 business days. |
| Fits | VS Code extensions: language support, linters, formatters, themes, snippets, debuggers, notebooks, testing tools and AI coding helpers. |
| Time needed | 1 to 2 hours the first time to set up tooling, the publisher and the README; later updates take minutes. |
Before you start
- Node.js and the latest @vscode/vsce installed.
- A publisher ID (permanent, used in your URLs) and a unique publisher display name.
- Authentication: a Personal Access Token with Marketplace Manage scope for 'All accessible organizations', or GitHub Actions trusted publishing. Global Azure DevOps PATs retire on December 1, 2026.
- A PNG icon of at least 128 x 128 px (256 x 256 for Retina). SVG icons are not allowed.
- A README.md whose images use https URLs, plus LICENSE and CHANGELOG.md files.
- package.json fields ready: unique name and displayName, description, categories, up to 30 keywords, repository and engines.vscode.
- No secrets in the package; check .env files before packaging.
How to list on VS Code Marketplace, step by step
Install vsce
Install the publishing tool with npm and keep it on the latest version. Only npm and yarn v1 are supported for dependencies.
Set up authentication
Create an Azure DevOps organization and a PAT with Marketplace Manage scope, or set up GitHub Actions trusted publishing with vsce publish --oidc. Microsoft recommends federated identity because global PATs are being retired.
Create your publisher
On the Marketplace management page, create a publisher with an ID and a name. The ID cannot be changed, so choose it carefully. Then run vsce login with that ID.
Finish the manifest and README
Fill in displayName, description, categories, keywords, icon, galleryBanner, repository and license in package.json. Write a README that explains setup and shows screenshots, since it becomes your listing page.
Package and test
Run vsce package to build a .vsix and install it locally to test. vsce blocks user SVG images and non-https image links at this point.
Publish
Run vsce publish, or upload the .vsix on the management page. The package is scanned for malware and secrets before it goes public.
Ship updates and pre-releases
Use vsce publish --pre-release for beta builds, with a version number different from your release. Microsoft suggests even minor numbers for releases and odd ones for pre-releases.
Apply for the verified badge later
After your extension has been on the Marketplace for 6 months and your domain is at least 6 months old, verify the domain with a DNS TXT record to get the blue check.
What the VS Code Marketplace form asks for
| Field | Limit | Tip |
|---|---|---|
| Publisher ID | – | Permanent and part of your extension URL, so use your brand name. |
| Publisher Name | – | Shown on the Marketplace; changing it later removes a verified badge. |
| name | Lowercase, no spaces | Must be unique; it forms the extension ID with your publisher. |
| displayName | – | VS Code uses it in search, so include the main task words. |
| description | – | One short sentence; it is also used for search. |
| categories | Fixed list | Pick only matching values such as Linters, Formatters, Themes or Snippets. |
| keywords | 30 keywords | Add terms users type, such as the language or framework names. |
| icon | PNG, at least 128 x 128 px | Use 256 x 256 for sharp display on Retina screens. |
| galleryBanner | – | Set a color and a light or dark theme that contrasts with your icon. |
| pricing | Free or Trial | Case-sensitive; defaults to Free. |
| repository / homepage / bugs | – | These appear under Resources; a public GitHub repo also fixes relative README links. |
| qna | – | Set false or a custom URL if you prefer GitHub issues over Marketplace Q&A. |
| badges | Approved providers only | Badges from unapproved hosts are rejected by vsce. |
| preview | – | Set true to mark an early extension as Preview. |
| sponsor | – | Add a URL to a sponsorship page if you accept support. |
Why submissions get rejected
- Malware found by the antivirus scan or bad behavior in the sandbox run.
- Secrets such as API keys or credentials found in the package, which blocks publishing.
- SVG icon, or user-provided SVG images in the README or CHANGELOG.
- README or CHANGELOG images that do not use https.
- Names that copy official publishers or popular extensions (name squatting).
- Name or displayName already taken, or a version that is not major.minor.patch.
- Malicious extensions reported and confirmed are removed and blocked, and VS Code uninstalls them.
Tips that make a difference
- Use 'Unpublish' if you might come back; 'Remove' deletes stats and permanently reserves the name.
- You cannot delete the latest version or reuse a deleted version number, so bump versions carefully.
- Set engines.vscode to at least 1.63.0 if you plan to ship pre-releases.
- Set the repository field so vsce rewrites relative links in your README, and use --githubBranch if your default branch is not main.
- Packages built on Windows lose the executable bit on files, so build on macOS or Linux if you ship scripts.
Example: what JustLaunched prepared
These are the texts Pushify prepared for JustLaunched, a real brand, before listing it on sites like VS Code Marketplace. See the full sample report ›
| Name | JustLaunched |
|---|---|
| Tagline | Launch board for founders and early adopters |
| Short description | JustLaunched is a free launch board where founders introduce new products and early adopters try them first, ask questions and share feedback. |
| Tags | product launch, launch platform, startup discovery, indie makers, early adopters, beta testers, launch deals, product hunt alternative, saas, startups |
Questions people ask
Is it free to publish a VS Code extension?
Microsoft's publishing guide does not mention any fee. You need a publisher and a way to authenticate, such as a PAT or GitHub Actions.
How long until my extension appears on the Marketplace?
The docs say an extension becomes public once the malware scan is clear, but they do not give a time. There is no human review queue described for normal publishing.
Can I use an SVG icon?
No. The icon must be a PNG of at least 128 x 128 px, and vsce also blocks user-provided SVG images in the README.
How do I get the verified publisher blue check?
You need an extension live for at least 6 months, a domain registered for at least 6 months, and the ability to add a DNS TXT record. Microsoft reviews the request within 5 business days.
Can I sell a paid extension?
The manifest supports a Free or Trial pricing label. The publishing docs do not describe a built-in payment system, so any license sales happen on your own site.
Sources
The VS Code Marketplace pages this guide was checked against.