Go

The proxy implements the Go module proxy protocol.

Endpoint: <proxy-url>/go

Authentication: the API key, embedded in the GOPROXY URL. The Go toolchain has no separate credential store for module proxies, which shapes everything else on this page.

Go refuses credentials in an HTTP module proxy URL, so an authenticated GOPROXY must be HTTPS.

Configure the environment

On Linux and macOS:

export SHIELDEDSTACK_API_KEY=YOUR_API_KEY_HERE
export GOPROXY="https://_:${SHIELDEDSTACK_API_KEY}@<proxy-host>/go,off"
export GONOPROXY="none"
export GOSUMDB="off"
export GONOSUMDB="*"

On Windows PowerShell:

$env:SHIELDEDSTACK_API_KEY = "YOUR_API_KEY_HERE"
$env:GOPROXY = "https://_:$($env:SHIELDEDSTACK_API_KEY)@<proxy-host>/go,off"
$env:GONOPROXY = "none"
$env:GOSUMDB = "off"
$env:GONOSUMDB = "*"

Each setting is load-bearing:

• ,off rather than ,direct. direct lets Go fall back to fetching straight from version control when the proxy does not answer, which silently bypasses policy. off makes that a failure instead.
• GONOPROXY=none. An inherited GONOPROXY or GOPRIVATE pattern will send matching modules directly to their source, around the proxy. Setting it to none clears any such pattern.
• GOSUMDB and GONOSUMDB. Turning off checksum database verification is appropriate when all module traffic is mediated. If you want public checksum verification kept, leave GOSUMDB on and scope GONOSUMDB narrowly to private module paths instead.

These are process-scoped, so the key is not written to Go’s persistent environment file.

Committing the configuration

Never commit or persist a credential-bearing GOPROXY. Commit a setup script that constructs it and expects SHIELDEDSTACK_API_KEY to come from a secret store or the CI platform:

export GOPROXY="https://_:${SHIELDEDSTACK_API_KEY}@<proxy-host>/go,off"
export GONOPROXY="none"
export GOSUMDB="off"
export GONOSUMDB="*"

In CI, inject the key from the platform secret store and build GOPROXY inside the job.

Verify

go mod download

The downloaded modules appear under Packages in the Control Plane, attributed to the project name on the API key.

Troubleshooting

The API key leaks into logs. GOPROXY contains the key, so never print it. When inspecting settings, ask for the non-secret ones by name: go env GONOPROXY GONOSUMDB GOSUMDB.

A previously persisted value keeps winning. If go env -w GOPROXY was used before, that stored value persists and may still hold an old key. Remove it with go env -u GOPROXY, then use process-scoped variables.

Modules still bypass the proxy. Check for a shell profile that re-exports GOPROXY, GOPRIVATE or GONOPROXY, and for job-level environment variables in CI.

Downloads fail with no fallback. That is ,off doing its job. The module is not available from the configured upstream.