pub token is one of the subcommands of the pub command.

It is used to manage a store of secret tokens for authenticating against third-party servers when publishing packages and retrieving dependencies.

The tokens are stored in a user-wide config dir.

It has three subcommands: add, list and remove.

If you try to dart pub get and have a dependency hosted on a private repository you may be asked to provide credentials:

$ dart pub get
Resolving dependencies... package repository requested authentication! You can provide credential using:
    pub token add

Go to and log in to obtain your token.

The last line is a message the server can provide to help you obtaining a token. Some servers might not provide such a message.

Adding credentials dart pub token add


To enter the credentials use dart pub token add, and type the credential on stdin.

$ dart pub token add
Enter secret token: <Type token on stdin>
 Requests to "" will now be 
 authenticated using the secret token.

In a scripting situation you can store the secret in an environment variable and use dart pub token add <hosted-url> --env-var <ENV_VAR_NAME>.

$ dart pub token add --env-var TOKEN_VAR
Requests to "" will now be authenticated using the secret token stored in the environment variable "TOKEN_VAR".

This will cause dart pub get to read whatever is stored in $TOKEN_VAR and use that as the authentication token.

You can set the environment variable in Bash with export TOKEN_VAR=... but that still doesn't prevent the command being logged.

Most CI environments has a way to inject secrets into an environment variable:

Listing credentials dart pub token list


To see a list of all active credentials use dart pub token list:

$ dart pub token list
You have secret tokens for 2 package repositories:

Removing credentials dart pub token remove


You can remove a single token with dart pub token remove:

$ dart pub token remove
Removed secret token for package repository:

Or remove all with remove --all:

$ dart pub token remove --all
pub-tokens.json is deleted.
Removed 1 secret tokens.