Service Account Tokens

Cargo sends the stored token value as the Authorization header. Include the authentication scheme in the stored token value.

Configure the registry in ~/.cargo/config.toml:

[registries]
nexus = { index = "sparse+https://example.nexus.com/repository/cargo-hosted/" }

[registry]
global-credential-providers = ["cargo:token"]

In ~/.cargo/credentials.toml:

# Bearer
[registries.nexus]
token = "Bearer sat.<value>"

# Basic — base64 of "<account>:sat.<value>"
[registries.nexus]
token = "Basic bmV4dXMtc2E6c2F0LmV4YW1wbGU="

Composer authentication is configured in auth.json in the project directory or in ~/.composer/auth.json. Configure credentials by hostname, not by full repository URL.

{
  "http-basic": {
    "example.nexus.com": {
      "username": "<account>",
      "password": "sat.<value>"
    }
  }
}

{
  "bearer": {
    "example.nexus.com": "sat.<value>"
  }
}

For Basic authentication, use ~/.netrc:

machine example.nexus.com
login <account>
password sat.<value>

For Bearer authentication, configure the repository to send the Authorization header:

git config http.extraHeader "Authorization: Bearer sat.<value>"

For Basic authentication, use ~/.netrc with GOAUTH=netrc. For Bearer authentication, use Go 1.24 or later and configure a GOAUTH helper command. The helper command prints the URL prefix and headers to attach to matching requests:

#!/bin/sh
printf 'https://example.nexus.com/repository/go-proxy/\n\nAuthorization: Bearer sat.<value>\n\n'

Then configure GOAUTH and GOPROXY:

export GOAUTH="/path/to/goauth-nexus.sh"
export GOPROXY="https://example.nexus.com/repository/go-proxy/,direct"

The Go toolchain sends GOAUTH credentials over HTTPS. If you use plain HTTP, the header is not sent and the request can return 401 Unauthorized.

For Hugging Face repositories, use the environment variable or CLI login flow so the client sends the service account token as a Bearer token. Set the Hugging Face endpoint and token:

export HF_ENDPOINT=https://example.nexus.com/repository/huggingface-proxy
export HF_TOKEN=sat.<value>

You can also use huggingface-cli login and enter the service account token when prompted. For Basic authentication, omit HF_TOKEN and include the service account name and token in HF_ENDPOINT.

For Basic authentication, configure the server entry in ~/.m2/settings.xml:

<server>
  <id>nexus</id>
  <username><account></username>
  <password>sat.<value></password>
</server>

For Bearer authentication, configure the Authorization header in the same server entry. Do not include a username or password in this server entry because Maven can fall back to those values and hide a rejected token.

<server>
  <id>nexus</id>
  <configuration>
    <httpHeaders>
      <property>
        <name>Authorization</name>
        <value>Bearer sat.<value></value>
      </property>
    </httpHeaders>
  </configuration>
</server>

For Bearer authentication, use _authToken` in .npmrc:

registry=https://example.nexus.com/repository/npm-group/
//example.nexus.com/repository/npm-group/:_authToken=sat.<value>

For Basic authentication, use _auth in .npmrc. The _auth value is the base64-encoded value of <account>:sat.<value>

registry=https://example.nexus.com/repository/npm-group/
always-auth=true
//example.nexus.com/repository/npm-group/:_auth=<base64-encoded-account-and-token>

Running npm login with the service account name and token also writes a working .npmrc configuration.

Use dart pub token add and enter the service account token when prompted:

dart pub token add https://example.nexus.com/repository/pub-hosted/

For CI environments, read the token from an environment variable:

dart pub token add https://example.nexus.com/repository/pub-hosted/ --env-var NEXUS_TOKEN

For Bearer authentication, configure download headers in .Rprofile:

options(repos = c(NEXUS = "https://example.nexus.com/repository/r-group"))
options(renv.download.headers = function(url) {
  c(Authorization = paste("Bearer", Sys.getenv("NEXUS_TOKEN")))
})

For Basic authentication, include the service account name and token in the repository URL:

options(repos = c(
  NEXUS = "https://<account>:sat.<value>@example.nexus.com/repository/r-group"
))

For Basic authentication, configure ~/.netrc:

machine example.nexus.com
login <account>
password sat.<value>

For Bearer authentication, configure ~/.netrc with token as the login value:

machine example.nexus.com
login token
password sat.<value>

For Bearer authentication, the host must not have an authentication entry in registries.json because that entry takes precedence.

Terraform and OpenTofu use Bearer authentication through the credentials block in ~/.terraformrc or terraform.rc on Windows:

credentials "example.nexus.com" {
  token = "sat.<value>"
}

Do not use a username-and-password credential pair for Terraform service account authentication.