dart pub token
pub token is one of the subcommands of the pub command.
The tokens are stored in a user-wide config dir.
It has three subcommands:
If you try to
dart pub get and have a dependency hosted
on a private repository you may be asked to provide credentials:
$ dart pub get
https://some-package-repo.com/my-org/my-repo package repository requested authentication! You can provide credential using:
pub token add https://some-package-repo.com/my-org/my-repo
Go to https://some-package-repo.com and log in to obtain your token.
The last line is a message the server can provide to help you obtaining a token. Some servers might not provide such a message.
dart pub token add
To enter the credentials use
dart pub token add,
and type the credential on stdin.
$ dart pub token add https://some-package-repo.com/my-org/my-repo
Enter secret token: <Type token on stdin>
Requests to "https://some-package-repo.com/my-org/my-repo" will now be
authenticated using the secret token.
In a scripting situation you can store the secret in an environment variable and
dart pub token add <hosted-url> --env-var <ENV_VAR_NAME>.
$ dart pub token add https://other-package-repo.com/ --env-var TOKEN_VAR
Requests to "https://other-package-repo.com/" will now be authenticated using the secret token stored in the environment variable "TOKEN_VAR".
This will cause
dart pub get to read whatever is stored in
use that as the authentication token.
You can set the environment variable in Bash with
export TOKEN_VAR=... but
that still doesn’t prevent the command being logged.
Most CI environments has a way to inject secrets into an environment variable:
dart pub token list
To see a list of all active credentials use
dart pub token list:
$ dart pub token list
You have secret tokens for 2 package repositories:
dart pub token remove
You can remove a single token with
dart pub token remove:
$ dart pub token remove https://other-package-repo.com
Removed secret token for package repository: https://other-package-repo.com
Or remove all with
$ dart pub token remove --all
pub-tokens.json is deleted.
Removed 1 secret tokens.