Configuring NuGet

Learn how to configure NuGet and the .NET SDK to use DepAegis as a private package source for restoring and publishing packages.

Adding DepAegis as a NuGet Source

The fastest way to add DepAegis as a package source is with the dotnet CLI. Provide an API key or access token for authentication:

dotnet nuget add source "https://app.depaegis.com/api/v1/nuget/v3/index.json" \
  --name "DepAegis" \
  --username "your-username" \
  --store-password-in-clear-text \
  --password "your-api-key"

The --store-password-in-clear-text flag is required on non-Windows platforms where the credential provider cannot use the OS keychain. On Windows, credentials are stored securely in the Windows Credential Manager by default.

nuget.config XML Format

You can also configure the source directly in a nuget.config file. Place this file in your project root, repository root, or user-level profile directory:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="nuget.org"
         value="https://api.nuget.org/v3/index.json" />
    <add key="DepAegis"
         value="https://app.depaegis.com/api/v1/nuget/v3/index.json" />
  </packageSources>

  <packageSourceCredentials>
    <DepAegis>
      <add key="Username" value="your-username" />
      <add key="ClearTextPassword" value="your-api-key" />
    </DepAegis>
  </packageSourceCredentials>
</configuration>

Never commit API keys to source control. Use environment variable substitution or user-level nuget.config files for credentials. See the Access Tokens guide for secure token management.

API Key Configuration

DepAegis uses API keys to authenticate NuGet operations. You can generate a key from the DepAegis dashboard under Settings → Access Tokens.

API keys can be scoped to:

Read-only — restore and install packages only.
Read & Write — publish new packages and versions.
Organization-scoped — limited to a specific organization's feeds.

To set the API key used for publishing, use the dotnet nuget push --api-key flag or configure it in your nuget.config:

dotnet nuget setapikey "your-api-key" --source "DepAegis"

Visual Studio Integration

DepAegis integrates seamlessly with Visual Studio's NuGet Package Manager. Once you've added the source (via CLI or nuget.config), it appears in the Package Manager UI:

Open Tools → Options → NuGet Package Manager → Package Sources.
Verify that your DepAegis source is listed and enabled.
When browsing or searching packages, select the DepAegis source from the dropdown in the Package Manager dialog.

For credential prompts, Visual Studio uses the NuGet Credential Provider for Visual Studio. DepAegis supports standard HTTP basic authentication, which Visual Studio handles natively.

Multiple Sources (DepAegis + nuget.org)

Most teams use DepAegis for private packages alongside the public nuget.org feed. NuGet supports multiple sources simultaneously. Use the <clear /> element to start fresh, then add both:

<packageSources>
  <clear />
  <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
  <add key="DepAegis" value="https://app.depaegis.com/api/v1/nuget/v3/index.json" />
</packageSources>

NuGet will search all enabled sources in parallel when restoring packages. To ensure private packages are resolved from DepAegis and public packages from nuget.org, you can use the packageSourceMapping feature introduced in NuGet 6.0+:

<packageSourceMapping>
  <packageSource key="DepAegis">
    <package pattern="MyCompany.*" />
    <package pattern="InternalLib.*" />
  </packageSource>
  <packageSource key="nuget.org">
    <package pattern="*" />
  </packageSource>
</packageSourceMapping>

Package source mapping ensures that packages matching your company's prefix (e.g. MyCompany.*) are always resolved from DepAegis, preventing dependency confusion attacks.

Verifying Configuration

After adding the source, verify it is correctly configured:

dotnet nuget list source

You should see output similar to:

Registered Sources:
  1.  nuget.org [Enabled]
      https://api.nuget.org/v3/index.json
  2.  DepAegis [Enabled]
      https://app.depaegis.com/api/v1/nuget/v3/index.json

To test that authentication works, try restoring a known private package:

dotnet restore --source "DepAegis"

← Previous

Scoped Packages

Publishing NuGet Packages