Home / Docs / NuGet Guide / NuGet.config

NuGet.config

Configure your project with a NuGet.config file for seamless package management.

⏱️ 5 min read

Overview

A NuGet.config file allows you to configure package sources at the solution or project level. This is useful for:

Sharing configuration with your team via source control
Configuring CI/CD pipelines
Using multiple package sources
Setting up fallback sources

Basic Configuration

Create a NuGet.config file in your solution root:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
    <add key="NugetHosting" value="https://nuget.nugethosting.com/v3/index.json" />
  </packageSources>
</configuration>

💡 Tip: The <clear /> element removes inherited sources, giving you full control over which sources are used.

Credentials Configuration

Add authentication for NugetHosting:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
    <add key="NugetHosting" value="https://nuget.nugethosting.com/v3/index.json" />
  </packageSources>
  <packageSourceCredentials>
    <NugetHosting>
      <add key="Username" value="api" />
      <add key="ClearTextPassword" value="YOUR_API_TOKEN" />
    </NugetHosting>
  </packageSourceCredentials>
</configuration>

⚠️ Security: Never commit API tokens to source control. Use environment variables or secret managers in CI/CD.

CI/CD Configuration

For CI/CD pipelines, use environment variables:

<!-- Use %VARIABLE% for Windows, $VARIABLE for Linux/Mac -->
<packageSourceCredentials>
  <NugetHosting>
    <add key="Username" value="api" />
    <add key="ClearTextPassword" value="%NUGET_TOKEN%" />
  </NugetHosting>
</packageSourceCredentials>

Then set the environment variable in your CI/CD:

# GitHub Actions
env:
  NUGET_TOKEN: ${{ secrets.NUGETHOSTING_TOKEN }}

Best Practices

✓

Commit NuGet.config (without credentials)

Share package sources with your team, but keep credentials separate.

✓

Use `<clear />`

Prevents inheriting unwanted sources from machine-level configs.

✓

Keep nuget.org as fallback

Ensures public packages can still be restored.

✗

Never commit tokens

Use .gitignore for local config files containing secrets.

dotnet CLI Publishing Packages