NuGet nuget.config credentials and VSS_NUGET_EXTERNAL cache in CI

Azure Artifacts restores need either credentials in nuget.config or the endpoints declared in VSS_NUGET_EXTERNAL_FEED_ENDPOINTS for the credential provider. When both are absent or point at a stale token, restore keeps returning 401.

What this error means

restore against an Azure Artifacts feed returns 401 even though a PAT exists, because the credential provider has no endpoint entry or the cached credential is stale.

dotnet

error: Unable to load the service index for source
      https://pkgs.dev.azure.com/org/_packaging/feed/nuget/v3/index.json.
      Response status code does not indicate success: 401 (Unauthorized).

Common causes

The credential provider has no endpoint entry

The Azure Artifacts credential provider reads VSS_NUGET_EXTERNAL_FEED_ENDPOINTS; without an entry for the feed it supplies no token.

A stale cached credential

An old credential cached by the provider (or a stale VSS_NUGET_EXTERNALCACHE) is reused, and it no longer authenticates.

How to fix it

Declare the feed endpoint for the credential provider

Set VSS_NUGET_EXTERNAL_FEED_ENDPOINTS with the feed URL and PAT from a secret.
Ensure the Azure Artifacts credential provider is installed on the runner.
Restore again so the provider supplies a fresh token.

.github/workflows/ci.yml

env:
  VSS_NUGET_EXTERNAL_FEED_ENDPOINTS: '{"endpointCredentials":[{"endpoint":"https://pkgs.dev.azure.com/org/_packaging/feed/nuget/v3/index.json","username":"az","password":"${{ secrets.AZ_PAT }}"}]}'

Clear a stale credential cache

Remove cached NuGet credentials so the provider re-authenticates with the current token.

Terminal

dotnet nuget locals http-cache --clear

How to prevent it

Provide feed endpoints to the credential provider explicitly in CI.
Fill the PAT from a rotating secret, not a hardcoded value.
Clear stale credential caches when rotating tokens.