> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/connectors/package-registries.md).

# Private Package Registries

Connect a private package source so Nullify can resolve dependency metadata and supported package operations for repositories that use it. Package-registry connections are separate from container image scanning and source-control access.

## Setup

**GitHub Packages (npm)** is the only package-registry connector currently available in the Settings → Connectors user interface. Open its card, provide the scope, machine-user credentials, and test package, then select **Connect**.

Configure the other registry types through the Admin API:

1. Use `GET /admin/integrations/catalog` to identify the provider, capability, and required fields available to your tenant.
2. Create a connection with `POST /admin/integrations/{providerId}/{capability}/connections`. Put the chosen catalog entry's configuration and credential values inside a `fields` object, using its exact schema keys; `displayName` is optional alongside `fields`. Endpoint and credential keys differ by provider. Create separate connections for distinct registry origins or ecosystems.
3. List connections with `GET /admin/integrations/connections`. When the connector supports it, test a saved connection with `POST /admin/integrations/connections/{connectionId}/test`.
4. Rotate a credential with `PUT /admin/integrations/connections/{connectionId}/rotate`, wrapping the replacement field values in a `fields` object. Disconnect with `DELETE /admin/integrations/connections/{connectionId}`.
5. Re-run the affected dependency workflow and check that private packages resolve. A successful connection test does not prove every package is accessible.

| Connector             | Configuration                                                                                                                                                        |
| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Private npm           | Registry URL, read token, optional `@scope`. An optional ecosystem default covers packages without a more specific scope/origin match.                               |
| Private Maven         | Repository URL, username, and password or API token.                                                                                                                 |
| Private PyPI          | PEP 503 index URL, username, and password/token. Use the index's required token username, often `__token__`.                                                         |
| Private Go proxy      | Proxy URL, private module pattern, token, and optional basic-auth username. The private pattern identifies modules that bypass public proxy/checksum services.       |
| Artifactory packages  | Base URL, repository key, ecosystem, and the credential fields shown by the connector. Use one connection per ecosystem/repository.                                  |
| Nexus packages        | Base URL, repository name, ecosystem, and the Name Code/Pass Code pair from a Nexus user token. The Name Code is not your login username.                            |
| AWS CodeArtifact      | An existing AWS cloud connection, domain, domain-owner account ID, region, repository, and ecosystem. Nullify obtains a short-lived authorization token at use time. |
| GitHub Packages (npm) | Scope, dedicated machine-user username, classic PAT, and a real private test package. An optional package-origin override supports the configured enterprise host.   |

At most one connection per ecosystem should be the default. Prefer explicit origins or scopes where multiple registries are used. Rotating a connection should preserve its intended package scope.

## GitHub Packages credentials

{% hint style="warning" %}
This connector requires a **classic PAT with `read:packages` from a dedicated machine user**. It does not accept GitHub App installation tokens or fine-grained PATs. Your existing GitHub App connection does not supply this package credential.
{% endhint %}

Give the machine user access to the private test package and authorize it for organization SSO when required. Nullify validates the credential by reading that package on connect and rotation; failed validation does not replace a working stored credential. Use the package origin shown for your GitHub environment rather than assuming the public npm host applies.

## API lifecycle

The API lifecycle above supports multiple connection instances for a registry. See the [Admin API](/api-reference/api-reference/api-admin.md). Do not place credentials in repository configuration, URLs, or support screenshots.