# nuget.config

> Configure nuget.config for the private NuGet feed: packageSources, packageSourceCredentials, where NuGet finds the file, and keeping the API token out of Git.

- **Product:** TX Text Control .NET Server
- **Section:** Documentation
- **Kind:** Topic
- **Path:** TX Text Control .NET Server > Installation Guide > NuGet Packages > Text Control Private NuGet Feed > nuget.config
- **1439 words**
- **Web URL:** https://docs.textcontrol.com/tx-text-control-dotnet-server/installation/nuget/private-feed/nuget-config/
- **LLMs URL:** https://docs.textcontrol.com/tx-text-control-dotnet-server/installation/nuget/private-feed/nuget-config/llms.txt
- **LLMs-Full URL:** https://docs.textcontrol.com/tx-text-control-dotnet-server/installation/nuget/private-feed/nuget-config/llms-full.txt

---

The `nuget.config` file tells NuGet where the Text Control Private NuGet Feed is and which credentials to use for it. You download a personalized file, put it where Visual Studio and the .NET CLI find it and keep the API token in it out of your source code repository.

### The Downloaded File

When an API token is created for you, you receive an email with a download link for your personalized `nuget.config` file. See [Creating an API Token](https://docs.textcontrol.com/tx-text-control-dotnet-server/installation/nuget/private-feed/api-token/llms-full.txt).

The file is ready to use. It already contains the feed URL, your email address and your API token, so you do not need to edit it. Because it contains your credentials, treat it like a password: do not share it with other developers, and do not commit it to source control. Every developer uses their own file.

### File Structure

A `nuget.config` file for the feed has the following structure. `YOUR_EMAIL` and `YOUR_API_TOKEN` stand for the values that your downloaded file already contains. Text Control's CI/CD examples generate a file with this structure at build time.

```xml
<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
    <add key="TextControl" value="https://www.textcontrol.com/nuget/v3/index.json" />
  </packageSources>
  <packageSourceCredentials>
    <TextControl>
      <add key="Username" value="YOUR_EMAIL" />
      <add key="ClearTextPassword" value="YOUR_API_TOKEN" />
    </TextControl>
  </packageSourceCredentials>
</configuration>
```

| Element | Meaning |
|---|---|
| `packageSources` | The package sources NuGet uses. |
| `clear` | Tells NuGet to ignore the package sources from configuration files it read before this one, such as your user-level file, so that the sources listed here are used. |
| `add key="nuget.org"` | The public nuget.org gallery, for packages such as `TXTextControl.Web.Blazor.DocumentEditor` and the Microsoft packages your project uses. |
| `add key="TextControl"` | The Text Control Private NuGet Feed. `TextControl` is the source name that you select in Visual Studio and pass to `--source` on the command line. |
| `packageSourceCredentials` / `TextControl` | The credentials for the source with the key `TextControl`. NuGet assigns them by the name of the child element, which is the source name. |
| `Username` | The email address the serial number is assigned to. |
| `ClearTextPassword` | Your API token, stored in plain text. |

### Where to Put the File

- **Project folder.** Copy the downloaded file to the root folder of your project. This is how Text Control's tutorials use it, both in Visual Studio and with the .NET CLI.
- **Solution folder.** NuGet reads `nuget.config` files from the solution folder and from every folder above it, up to the root of the drive. If your solution file and your project are in different folders and Visual Studio does not show the **TextControl** package source, put the file into the solution folder. See [Common NuGet configurations](https://learn.microsoft.com/en-us/nuget/consume-packages/configuring-nuget-behavior) on Microsoft Learn.
- **A configuration file that Visual Studio lists.** If Visual Studio does not recognize the file in your project folder, you can copy its content into one of the configuration files listed in the Visual Studio package manager settings. See [Visual Studio](https://docs.textcontrol.com/tx-text-control-dotnet-server/installation/nuget/private-feed/visual-studio/llms-full.txt).

When NuGet finds several configuration files, it combines their package sources. A `clear` element makes NuGet ignore the package sources that were defined before it. When you pass a file explicitly, for example with `dotnet restore --configfile nuget.config`, NuGet uses only the settings from that file.

### Keep Credentials Out of Source Control

The API token in `nuget.config` gives access to the packages licensed to you. Keep it out of your repository:

- **Do not commit the file.** If the file is in a folder that is under source control, exclude it, for example with an entry in your `.gitignore` file.
- **Use your own file on your machine.** TX Text Control is licensed per developer, and every developer receives their own token and file.
- **Generate the file on build servers.** Store the feed URL, the email address and the API token as secrets in your CI/CD platform, and create `nuget.config` during the build, before the packages are restored. This keeps the credentials out of source control and out of the repository history. [CI/CD Authentication](https://docs.textcontrol.com/tx-text-control-dotnet-server/installation/nuget/private-feed/ci-cd/llms-full.txt) shows this for GitHub Actions, GitLab, Azure DevOps, Jenkins, Bitbucket, TeamCity and Docker.

If the file was committed or shared by mistake, ask the account holder to delete the token in **Manage API tokens** and to create a new one.

### Next Steps

- [Visual Studio](https://docs.textcontrol.com/tx-text-control-dotnet-server/installation/nuget/private-feed/visual-studio/llms-full.txt) — select the TextControl source and install packages.
- [.NET CLI](https://docs.textcontrol.com/tx-text-control-dotnet-server/installation/nuget/private-feed/dotnet-cli/llms-full.txt) — search, add and restore packages.
- [CI/CD Authentication](https://docs.textcontrol.com/tx-text-control-dotnet-server/installation/nuget/private-feed/ci-cd/llms-full.txt) — generate the file from secrets in a pipeline.
- [NuGet Authentication](https://docs.textcontrol.com/tx-text-control-dotnet-server/troubleshooting/nuget-authentication/llms-full.txt) — solve problems with the feed.

---

## Nearby

- **Previous:** [Creating an API Token](https://docs.textcontrol.com/tx-text-control-dotnet-server/installation/nuget/private-feed/api-token/llms-full.txt)
- **Next:** [Visual Studio](https://docs.textcontrol.com/tx-text-control-dotnet-server/installation/nuget/private-feed/visual-studio/llms-full.txt)