Setup Guide

The Setup Guide tab provides your credentials and step-by-step instructions to configure your package manager to proxy through Secure Registry. Once configured, the security controls set in the Policy tab are applied to every request.

Use the Registry selector to choose an ecosystem (npm or PyPI); the credentials and integration steps update for the selected ecosystem.

Your credentials

The Setup Guide displays the credentials your clients need to authenticate to Secure Registry:

• Registry URL: the Secure Registry endpoint to use as your upstream (for example, https://registry.stepsecurity.io/javascript).
• Username: your tenant username.
• API Key: select Primary or Secondary from the dropdown and reveal or copy the key.

Primary and Secondary API keys are supported so you can rotate without downtime: issue the Secondary, switch clients over, then rotate the Primary.

Integration paths

Pick the path that matches how packages reach your environment and follow the in-app instructions:

• JFrog Artifactory: for teams that already proxy npm through Artifactory. Create a remote npm repository, set its upstream URL to your Secure Registry endpoint, and add your credentials as the repository authentication.
• Google Artifact Registry: for teams using GAR as their npm proxy.
• Sonatype Nexus Repository: for teams using Nexus as their npm proxy.
• Direct npm (.npmrc): for teams without an artifact manager, configuring npm to point directly at Secure Registry.

After configuring, use the test sequence in the Setup Guide to confirm requests are flowing through Secure Registry.

Setting up source attribution

Source attribution lets you trace each request in the Policy Evaluations log back to the developer machine or CI pipeline that made it. It is configured by appending an identifier suffix to your API key in the auth token. Attribution is optional: clients without a suffix still work, but their requests appear in the log without a source.

The token format is the API key, followed by ::, followed by the identifier:

<your-api-key>::<IDENTIFIER>

Developer machines

To attribute requests to a developer machine, append the device serial ID using the dev: prefix:

npm config set //registry.stepsecurity.io/javascript/:_authToken "<your-api-key>::dev:<DEVICE-SERIAL-ID>"

In the Policy Evaluations log, these requests show a Developer Machine source, and the Source Identifier links to that device's page.

CI/CD pipelines (GitHub Actions)

To attribute requests to a specific pipeline run, store the API key as a secret and append a gha: identifier built from the workflow context. Store the key as a secret (for example, STEPSECURITY_NPM_TOKEN) rather than committing it:

- name: Configure npm registry
  env:
    IDENTIFIER: "gha:${{ github.repository }}/${{ github.run_id }}/${{ job.check_run_id }}"
    NPM_TOKEN: ${{ secrets.STEPSECURITY_NPM_TOKEN }}
  run: |
    npm config set registry https://registry.stepsecurity.io/javascript
    npm config set //registry.stepsecurity.io/javascript/:_authToken "${NPM_TOKEN}::${IDENTIFIER}"

- name: Install dependencies
  run: npm ci

In the Policy Evaluations log, these requests show a GitHub Actions source, and the Source Identifier links to the corresponding Harden-Runner workflow run.

Never commit the raw API key. Use an environment variable or CI secret, as shown above.