Dart

The proxy implements the pub.dev hosted package protocol, so both dart pub and flutter pub resolve through it.

Endpoint: <proxy-url>/dart

Authentication: the API key, sent as a bearer token. Use HTTPS, so the token is encrypted in transit.

Configure Dart and Flutter

export PUB_HOSTED_URL=<proxy-url>/dart
export SHIELDEDSTACK_API_KEY=YOUR_API_KEY_HERE
dart pub token add <proxy-url>/dart --env-var SHIELDEDSTACK_API_KEY

--env-var is the important part: Pub stores the name of the environment variable rather than the key itself, so the stored token file holds no secret.

PUB_HOSTED_URL has to be set anywhere dart pub or flutter pub runs, including CI.

Some dependencies do not go through this route at all. Anything with an explicit hosted: URL, plus Git, path, and SDK dependencies, resolves independently of PUB_HOSTED_URL and will not be seen by the proxy.

Committing the configuration

The token registration stores a variable name, not a key, but it is per machine. On every workstation and every clean CI runner, register it before restoring:

export PUB_HOSTED_URL=<proxy-url>/dart
export SHIELDEDSTACK_API_KEY=YOUR_API_KEY_HERE
dart pub token add "$PUB_HOSTED_URL" --env-var SHIELDEDSTACK_API_KEY
dart pub get   # or: flutter pub get

Verify

dart pub get
# or: flutter pub get

The resolved packages appear under Packages in the Control Plane, attributed to the project name on the API key.

Troubleshooting

Requests go to pub.dev. PUB_HOSTED_URL is not set in the shell or CI job that actually runs the command.

401 or 403 on a fresh runner. dart pub token add has not run in that job. It is per machine, so an ephemeral runner needs it every time.

After key rotation. Re-run dart pub token add <proxy-url>/dart --env-var SHIELDEDSTACK_API_KEY.

A dependency is missing from the inventory. Check whether it declares an explicit hosted: URL, or is a Git, path, or SDK dependency. Those bypass PUB_HOSTED_URL by design.