Skip to content
ShieldedStackShieldedStackShieldedStack Docs

Quick Start

Three things stand between a fresh workspace and a tracked install: an API key, the proxy base URL, and a package manager configured to use both.

1. Generate an API key

Section titled “1. Generate an API key”
  1. Open the ShieldedStack Control Plane.
  2. Go to Settings -> API Keys.
  3. Click Generate New API Key.
  4. Enter a Project Name for the application or pipeline that will use the key.
  5. Optionally set an expiration period.
  6. Click Generate API Key.
  7. Copy the key immediately. It is not shown again.

The project name identifies the application, repository, service, or pipeline behind each install. Valid characters are letters, numbers, hyphens (-), underscores (_), and periods (.), so frontend-web, backend.api, mobile_app, and data-pipeline are all fine.

Project names are how usage is grouped, which has three consequences worth knowing before you pick one:

  • Separate environments want separate names, such as myapp-dev, myapp-staging, and myapp-prod.
  • Several keys can share one project name, which is what makes key rotation and multiple build agents possible.
  • Revoking a key does not delete project data. History is preserved, and a new key with the same project name continues tracking under that project.

2. Know the proxy base URL

Section titled “2. Know the proxy base URL”

Every package manager configuration is built from one value.

<proxy-url> is the base URL of the package proxy, without a trailing slash. Each ecosystem is served under its own path beneath it:

Ecosystem Endpoint
NuGet <proxy-url>/nuget/v3/index.json
npm <proxy-url>/npm/
PyPI <proxy-url>/pip/
Maven <proxy-url>/maven/
Go <proxy-url>/go
Cargo sparse+<proxy-url>/cargo/
RubyGems <proxy-url>/rubygems
Dart <proxy-url>/dart

Some configuration formats need the host rather than the full URL. Where a page writes <proxy-host>, it means the same value without the scheme, and <proxy-host-and-port> includes the port when the deployment uses a non-default one.

Use HTTPS in production. Go refuses authenticated HTTP proxy URLs outright, and a Dart bearer token must not cross an unencrypted connection.

3. Configure a package manager

Section titled “3. Configure a package manager”

Pick your ecosystem and follow its page:

  • Ecosystems index lists every supported registry and which page covers each tool.

Each page carries the endpoint, per-client configuration, how to commit that configuration without committing a secret, and troubleshooting for that ecosystem.

4. Confirm it is being tracked

Section titled “4. Confirm it is being tracked”
  1. Install a package through the configured package manager.
  2. Open the Control Plane and go to Packages.
  3. The package appears with its name, version, project name, download timestamp, and security information.

If the install succeeded but nothing appears, the request did not route through the proxy. The ecosystem pages cover the usual causes, most often a scoped registry override or a config file in a location the client did not read.

Where to go next

Section titled “Where to go next”