Dart

The proxy implements the pub.dev hosted package protocol, so both dart pub and flutter pub resolve through it.

Endpoint: <proxy-url>/dart

Authentication: the API key, sent as a bearer token. Use HTTPS, so the token is encrypted in transit.

Configure Dart and Flutter

export PUB_HOSTED_URL=<proxy-url>/dart
export SHIELDEDSTACK_API_KEY=YOUR_API_KEY_HERE
dart pub token add <proxy-url>/dart --env-var SHIELDEDSTACK_API_KEY

--env-var is the important part: Pub stores the name of the environment variable rather than the key itself, so the stored token file holds no secret.

PUB_HOSTED_URL has to be set anywhere dart pub or flutter pub runs, including CI.

Some dependencies do not go through this route at all. Anything with an explicit hosted: URL, plus Git, path, and SDK dependencies, resolves independently of PUB_HOSTED_URL and will not be seen by the proxy.

Committing the configuration

The token registration stores a variable name, not a key, but it is per machine. On every workstation and every clean CI runner, register it before restoring:

Dart
Flutter

export PUB_HOSTED_URL=<proxy-url>/dart
export SHIELDEDSTACK_API_KEY=YOUR_API_KEY_HERE
dart pub token add "$PUB_HOSTED_URL" --env-var SHIELDEDSTACK_API_KEY
dart pub get

export PUB_HOSTED_URL=<proxy-url>/dart
export SHIELDEDSTACK_API_KEY=YOUR_API_KEY_HERE
flutter pub token add "$PUB_HOSTED_URL" --env-var SHIELDEDSTACK_API_KEY
flutter pub get

dart pub get

flutter pub get

The resolved packages appear under Packages in the Portal, attributed to the project name on the API key.

Names in package filters

pub.dev names are lowercase with underscores, so write the name as it appears on pub.dev: shared_preferences, not shared-preferences. An allow rule or vulnerability exception applies only to that exact name; deny rules also match other casings. See Package names for how every ecosystem compares names.

Troubleshooting

Requests go to pub.dev. PUB_HOSTED_URL is not set in the shell or CI job that actually runs the command.

401 or 403 on a fresh runner. dart pub token add has not run in that job. It is per machine, so an ephemeral runner needs it every time.

After key rotation. Re-run dart pub token add <proxy-url>/dart --env-var SHIELDEDSTACK_API_KEY.

A dependency is missing from the inventory. Check whether it declares an explicit hosted: URL, or is a Git, path, or SDK dependency. Those bypass PUB_HOSTED_URL by design.