Proxy Endpoints
All paths are relative to <proxy-url>, the base URL of the package proxy. Reproduce each one
exactly, trailing slash included or omitted as shown: the proxy routes every ecosystem identically, but
the clients differ over whether the configured value is a directory to append to or a base they add
their own leading slash to.
| Ecosystem | Endpoint | Authentication | Upstream |
|---|---|---|---|
| NuGet | /nuget/v3/index.json |
Basic, key as password | api.nuget.org |
| npm | /npm/ |
Bearer | registry.npmjs.org |
| PyPI | /pip/ |
Basic, key as password | pypi.org, files.pythonhosted.org |
| Maven | /maven/ |
Basic, key as password | repo1.maven.org |
| Go | /go |
Basic, in the GOPROXY URL |
proxy.golang.org |
| Cargo | /cargo/ |
Authorization header, Bearer prefix included in the stored token |
index.crates.io, crates.io |
| RubyGems | /rubygems |
Basic, key as password | rubygems.org |
| Dart | /dart |
Bearer | pub.dev |
Authentication
Section titled “Authentication”The proxy accepts the API key two ways, and clients pick whichever their ecosystem uses:
- Basic, with the key as the password. The username is not checked, so
_is used throughout the documentation as a placeholder. - Bearer, with the key as the token.
A request with no credentials, or an unrecognised key, is answered with 401 and a WWW-Authenticate challenge, which is what prompts package managers to send credentials.
Notes per ecosystem
Section titled “Notes per ecosystem”Cargo uses the sparse protocol, so the configured value is sparse+<proxy-url>/cargo/ rather than the bare path. Cargo forwards the stored token verbatim, so the Bearer prefix has to be part of the token value.
Go has no credential store for module proxies, so the key is embedded in GOPROXY. Go refuses credentials over HTTP, so this endpoint requires HTTPS in any authenticated configuration.
npm has a second route for audit requests, under /npm/-/npm/v1/security/, which is served from the same upstream.
PyPI serves package files from a second upstream, so /pip/packages/ proxies files.pythonhosted.org while /pip/ serves the simple index.
Maven proxies Maven Central. The Gradle Plugin Portal is a separate repository and is not served by this route.
Dart honours PUB_HOSTED_URL. Dependencies declaring an explicit hosted: URL, and Git, path, and SDK dependencies, resolve independently of it and never reach the proxy.