Package credentials and recovery

A publisher key is a secret. Do not put it in a manifest, repository, shell history, issue, or build log.

Prerequisites

Create a key with publish scope through the registry account surface. Put the key in your operating-system secret manager or CI secret manager. Plan a revoke and rotate action before you publish.

Actions

1. For one process, inject the key as BESKID_PCKG_API_KEY from the secret manager. Do not type a literal value into a committed script.

2. Save the injected value on a trusted host only when repository-local CLI configuration is necessary. The configure command receives the key through process arguments, and the file must stay outside Git:

   printf '%s\n' '.beskid/pckg/repositories.json' >> .gitignore
   beskid pckg configure --api-key "${BESKID_PCKG_API_KEY}"

   The CLI writes .beskid/pckg/repositories.json. On Unix, it applies mode 0600. Protect the file with operating-system permissions on other systems.

3. Verify the selected identity:

   beskid pckg whoami

4. Stop new downloads of a faulty version:

   beskid pckg yank Acme.Math --version 1.0.0

5. Restore it only when the same artifact is safe again:

   beskid pckg unyank Acme.Math --version 1.0.0

Expected result

beskid pckg whoami reports authenticated=true for the intended publisher. A successful yank reports version yanked. The yanked artifact remains immutable but is unavailable to new downloads. Unyank restores download eligibility.

Recovery

For authentication required, confirm that the key is active and has publish scope. Do not fall back to a browser cookie in automation. If you expose a key, revoke it in the registry and rotate it in every secret manager. Remove the local configuration file, then verify the replacement with whoami. If you yanked the wrong version, inspect the coordinate before you run unyank.

Next task

Return to publish a package or consume a package.