Home / Docs / API Reference / API Tokens

API Tokens

Create and manage API tokens for authenticating with NugetHosting services.

⏱️ 5 min read

Overview

API tokens provide secure, revocable access to NugetHosting services. Use them for:

Publishing NuGet packages
Pushing and pulling Docker images
CI/CD pipeline authentication
Programmatic API access

💡 Tip: Create separate tokens for different purposes (e.g., one for CI/CD, one for local development).

Creating Tokens

To create a new API token:

Go to Settings → Access Tokens
Click "Create Token"
Enter a descriptive name (e.g., "GitHub Actions CI")
Select the required scopes
Click "Create"

⚠️ Important: Copy your token immediately! It won't be shown again.

Token Scopes

When creating a token, you select permissions in the UI. These translate to technical API scopes based on the token type:

UI Permissions → API Scopes

UI Permission	NuGet Token	Docker Token	Combined Token
Read packages	`nuget:pull`	`container:pull`	`nuget:pull` `container:pull`
Upload packages	`nuget:push`	`container:push`	`nuget:push` `container:push`
Delete packages	`nuget:delete`	`container:delete`	`nuget:delete` `container:delete`

💡 Example: If you create a "NuGet Only" token with "Read" and "Upload" permissions, your token will have scopes: nuget:pull + nuget:push

Scope Reference

Scope	Description
`nuget:pull`	Download/restore NuGet packages
`nuget:push`	Push new NuGet packages
`nuget:delete`	Delete NuGet packages
`container:pull`	Pull Docker images
`container:push`	Push Docker images
`container:delete`	Delete Docker images

Using Tokens

NuGet CLI

dotnet nuget add source https://nuget.nugethosting.com/v3/index.json \
  -n NugetHosting -u api -p YOUR_TOKEN

Docker CLI

docker login registry.nugethosting.com -u api -p YOUR_TOKEN

HTTP API

curl -H "Authorization: Bearer YOUR_TOKEN" \
  https://api.nugethosting.com/v1/packages

Revoking Tokens

If a token is compromised or no longer needed:

Go to Settings → Access Tokens
Find the token in the list
Click "Revoke"
Confirm the revocation

⚠️ Warning: Revoking a token is immediate and irreversible. Any services using that token will stop working.

Best Practices

✓

Use descriptive names

Name tokens after their purpose (e.g., "Production CI", "Local Dev").

✓

Use minimal scopes

Only grant the permissions each token actually needs.

✓

Rotate tokens regularly

Create new tokens and revoke old ones periodically.

✗

Never commit tokens to source control

Use environment variables or secret managers.

✗

Don't share tokens between users

Each user should have their own tokens for accountability.

CI/CD Integration Authentication