NuGet restore "Response status code 403" Private Feed in CI

By Daniel Zoghalchali·Latchkey

A 403 (unlike 401) means the credential was accepted but is not authorized for this feed or package. The token is valid yet under-scoped - read permission is missing, the feed is restricted to certain identities, or org SSO has not been authorized for the PAT.

What this error means

Restore fails with "Response status code does not indicate success: 403 (Forbidden)" for the private source. It reproduces with the same token until permissions are widened.

error : Failed to retrieve information about 'Contoso.Internal' from remote source.
error :   Response status code does not indicate success: 403 (Forbidden).

Common causes

The token lacks read permission on the feed

A PAT authenticates but was issued without the package/feed read scope, so the feed forbids access.

SSO authorization is required for the token

An org with SAML SSO requires the PAT to be explicitly authorized; until then every request is 403.

How to fix it

Grant the token feed read permission

1. Add the CI identity/token to the feed's readers (or correct the PAT scope).
2. For org SSO, authorize the PAT for the organization.
3. Update the CI secret and re-run restore.

Verify the feed allows the CI identity

1. Check the feed's permission settings for the service account/app used by CI.
2. Confirm the package source URL in nuget.config is the intended feed.
3. Re-run after permissions propagate.

How to prevent it

• Scope feed tokens with read access and authorize them for SSO orgs up front.
• Use a dedicated CI service identity with explicit feed permissions.
• Document required token scopes alongside the nuget.config.

Frequently asked questions

Related guides

References

• .NET documentation
• GitHub Actions documentation