NuGet 407 vs 401: Proxy Login or Private-Feed Credentials?
Separate NuGet feed credentials from forward-proxy credentials, and inspect the configuration used by the tool that actually performs restore.
A NuGet restore can require both a forward-proxy account and a private-feed account. Use the response to decide which configuration to inspect:
| Observation | Start here |
|---|---|
| Proxy returns 407 | The route and account used to reach the forward proxy |
| Package source returns 401 | The feed's authentication configuration |
| Connection or TLS fails before a response | The endpoint, transport, and certificate evidence |
A feed token cannot answer the proxy's 407. Likewise, a connection or TLS failure before a response has not established which password is wrong.
Configure the proxy separately from the feed
NuGet's proxy entry belongs under config. For a route without embedded credentials:
<configuration>
<config>
<add key="http_proxy" value="http://proxy.example:8080" />
</config>
</configuration>Merge this example into the appropriate existing configuration. For a public feed where public intermediaries are permitted, the HTTP proxy list offers a candidate for this credential-free route. Keep package sources in their own section; replacing a feed URL with a generic proxy address asks the intermediary for packages.
The documented http_proxy.password value is encrypted. Use the supported configuration tooling rather than writing plaintext into that field or copying an encoded-looking value from another machine as though it were a portable credential format.
Inspect the restore that actually fails
Name the client, user and launch environment, then locate its effective configuration hierarchy. User, machine and solution settings can contribute. An old devenv.exe.config fix concerns a particular Visual Studio process; it does not establish what a command-line restore or build service reads. Preserve working package sources and policy while locating an obsolete proxy entry.
After authentication works, follow any later failed URL. Feed metadata and package content can use different endpoints, so one accepted request does not establish the complete restore route. Preserve normal package-signature and TLS validation while correcting it.