Telerik Private NuGet Source

This article explains how to add the private Telerik NuGet package feed to your environment. You can use it to obtain the Telerik UI for Blazor components instead of setting up a local NuGet feed.

The benefit of using an online NuGet source is that you will receive notifications for newer component versions.

You can set up the remote Telerik NuGet feed in the following ways:

• Use Visual Studio
• Use the .NET CLI
• Edit the Nuget.Config file

Regardless of how you set up the Telerik NuGet feed, you must first generate a NuGet API key needed for the authentication.

Never hard-code your Telerik NuGet API keys in a NuGet.Config file in a GitHub repository, Docker image, or any location that may be accessed by unauthorized parties. An API key is valuable and bad actors can use it to access the NuGet packages that are licensed under your account. A credentials abuse can lead to a review of the affected Telerik account.

For NuGet-related issues, see NuGet Feed Troubleshooting.

For information on automated builds, CI and CD, see CI, CD, Build Server.

Generate a NuGet API Key

As the Telerik NuGet server requires authentication, the first step is to obtain an API key that you will use instead of a password. Using an API key instead of a password is a more secure approach, especially when working with the .NET CLI or a NuGet.Config file.

1. Go to the API Keys page in your Telerik account.
2. Click Generate New Key +.
3. In the Key Note field, add a note that describes the API key.
4. Click Generate Key.
5. Select Copy and Close. Once you close the window, you can no longer copy the generated key. For security reasons, the API Keys page displays only a portion of the key.
6. Store the generated NuGet API key as you will need it in the next steps.

Whenever you need to authenticate your system with the Telerik NuGet server, use api-key as the username and your generated API key as the password.

Use Visual Studio

When adding NuGet sources in Visual Studio, the credentials are encrypted and stored outside the NuGet.Config file.

Refer to the Microsoft documentation about using packages in Visual Studio, or follow the steps below for Visual Studio on Windows.

1. Open Visual Studio and go to Tools > NuGet Package Manager > Package Manager Settings > Package Sources.

2. Click the + button at the top right-hand side.

3. Add the Telerik Feed URL https://nuget.telerik.com/v3/index.json and choose a Name for that package source (for example, "TelerikOnlineFeed").

4. Click OK.

5. Open a project that references a Telerik NuGet package. For example, generate one with the New Project Wizard.

   Remove local NuGet.Config files that contain information about Telerik packages from the solution.

6. Rebuild the solution.

7. In the Windows authentication prompt:

   7.1. Enter api-key in the User Name field.

   7.2. Enter your NuGet API key in the Password field.

   7.3. Check the Remember My Password checkbox.

8. Your project should now build and restore all packages—including those from nuget.org and from Telerik.

If you experience issues, see the NuGet Feed Troubleshooting article.

Use the .NET CLI

To add the Telerik NuGet package source with the .NET CLI, use the dotnet nuget add source command. The command shown below creates or updates a NuGet.Config file for you, so you don't have to edit it manually:

• The command adds the Telerik NuGet source, uses your NuGet API key for authentication, and stores the API key in plain text in the global config file.
• The backslashes \ enable multi-line commands for better readability in terminals that support them.

Use the .NET CLI to add the Telerik NuGet source

dotnet nuget add source https://nuget.telerik.com/v3/index.json \
--name TelerikOnlineFeed \
--username api-key \
--password <YOUR-NUGET-API-KEY> \
--store-password-in-clear-text

If you have already stored the Telerik package source, you can update the configuration with the command below.

Use the .NET CLI to update the Telerik NuGet source

dotnet nuget update source "TelerikOnlineFeed" \
--source "https://nuget.telerik.com/v3/index.json" \
--username api-key \
--password <YOUR-NUGET-API-KEY> \
--store-password-in-clear-text

Edit the NuGet.Config File

NuGet package sources and other settings are stored in a NuGet.Config file. You can read more about the file structure in the Microsoft article NuGet.Config Reference.

Make sure you are familiar with how such configurations work. Refer to Common NuGet Configurations for details about the possible file locations and how multiple NuGet.Config files work.

To edit a NuGet.Config file and add the Telerik feed, you need to:

1. Ensure you are editing the correct and desired config file. You can also create a new one with the dotnet new nugetconfig command.

2. Add the Telerik package source to the config file. For the authentication, use your NuGet API key as a password and api-key as a username. Add the API key in plain text, because the .NET Core NuGet tooling does not fully support encrypted credentials. Here is an example of how your NuGet.Config file can look like:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <packageSources>
    <!--To inherit the global NuGet package sources remove the <clear/> line below -->
    <clear />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
    <add key="TelerikOnlineFeed" value="https://nuget.telerik.com/v3/index.json" />
    </packageSources>
    <packageSourceCredentials>
    <TelerikOnlineFeed>
        <add key="Username" value="api-key>" />
        <add key="ClearTextPassword" value="YOUR-NUGET-API-KEY" />
    </TelerikOnlineFeed>
    </packageSourceCredentials>
</configuration>

Package Source Mapping

The Telerik.UI.for.Blazor NuGet package and most of its dependencies reside on nuget.telerik.com. On the other hand, the Telerik icon packages and the Telerik.Licensing package reside on nuget.org. The correct package source mapping configuration should be similar to the one below.

Make sure that the key values in the packageSourceMapping section match the key values in the packageSources section, otherwise you will get a "Package not found" error.

packageSourceMapping configuration for Telerik UI for Blazor and other Telerik Packages

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
    <packageSources>
        <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
        <add key="TelerikOnlineFeed" value="https://nuget.telerik.com/v3/index.json" />
    </packageSources>

    <packageSourceMapping>
        <packageSource key="nuget.org">
            <package pattern="*" />
            <package pattern="Telerik.Licensing" />
            <package pattern="Telerik.FontIcons" />
            <package pattern="Telerik.SvgIcons" />
        </packageSource>
        <packageSource key="TelerikOnlineFeed">
            <package pattern="Telerik*" />
            <package pattern="Kendo*" />
            <package pattern="UI.for*" />
            <package pattern="JustMock*" />
        </packageSource>
    </packageSourceMapping>
</configuration>

Access NuGet Packages behind Firewall

To access the Telerik NuGet feed behind a firewall that restricts outgoing requests, you may need to allow the following domains:

• nuget.telerik.com, which provides authentication and license verification
• downloads.cdn.telerik.com, which hosts the NuGet packages

The firewall must allow some of the requests to be redirected from nuget.telerik.com to downloads.cdn.telerik.com.

Troubleshooting

See the NuGet Troubleshooting article for tips about common pitfalls when working with the Telerik NuGet feed.

Next Steps

Once you have the Telerik NuGet source set up, follow the instructions to create a Telerik Blazor app.

Further Reading

You may find useful the following Microsoft articles on securing your NuGet feed setup and supply chain as general best practices:

• Lock down your dependencies using configurable trust policies - Blog Post
• How to Scan NuGet Packages for Security Vulnerabilities - Blog Post
• Best practices for a secure software supply chain - MSDN docs

Telerik provides signed NuGet packages that you can verify.

See Also

• NuGet Feed Troubleshooting
• CI, CD, Build Server