 is deprecated and stops working on November 20, 2026.

 with a username and password — including from scripts and CI jobs — you need to switch to an API key before that date.

To improve API key protection, Cloudsmith is moving to a model in which keys are not stored in a retrievable form, in line with security best practices. Because 

 work by exchanging your credentials for your stored API key, the CLI can no longer fetch an API key on your behalf.

Until November 20, the commands work as they do today and print a deprecation warning. After that date, they fail with a message explaining how to get an API key.

To migrate from username and password to API key authentication:

, and click the button on the right side of the table row to rotate your key.

 environment variable, or add it to your CLI config — see 

 in the Cloudsmith documentation for details.

Update any scripts or pipelines that call 

To authenticate with single sign-on (SSO) instead, run:

Store artifacts closer to your users and CI/CD pipelines in India, so downloads are faster. Select 

 as your storage region when creating a new repository, or transfer an existing one via a repository’s settings.

Custom storage regions are available for Ultra and Enterprise plans. For details, see 

Mumbai is now a supported storage region

Setting usage limits on your Cloudsmith workspace (workspace 

.) used to mean dragging sliders. Customers told us this was cumbersome and imprecise. Today we’ve simplified usage limits - now you simply input the value of your desired limit. 

 each limit shows the artifact data and package delivery your plan already includes, so it’s clear what you’re adding on top.

 when you save, validation messages appear next to the input they apply to, so you can see which value needs changing.

Set exact usage limits with numerical inputs

 upstreams, with configuration built into the Libraries tab.

ActiveState provides curated open-source packages rebuilt from verified source code, scanned, signed, and maintained to address known vulnerabilities.

 upstream: select it, choose a library, name the upstream, and add your ActiveState credentials — Cloudsmith fills in the proxy URL.

ActiveState Curated Catalog upstreams are available for the following libraries:

Proxy and cache packages from your ActiveState Curated Catalog

The Cloudsmith CLI now authenticates from Buildkite pipelines and Google Cloud workloads with OpenID Connect (OIDC), so no Cloudsmith API key needs to live on your build hosts. It can also list packages from connected repositories alongside your own.

v1.29.0 adds Buildkite to the CI/CD platforms that the CLI detects automatically. In a Buildkite job, the CLI asks the Buildkite agent for an OIDC token and exchanges it for a short-lived Cloudsmith token.

First, create an OIDC provider in your Cloudsmith workspace with these settings:

, set to the slug of your Buildkite organization. Buildkite signs tokens for all organizations with the same keys, so this claim keeps other organizations out. You can add other claims from the token, such as 

: the service account that the pipeline authenticates as.

Then set your workspace and service account in the pipeline:

Authentication Method: OIDC Auto-Discovery

v1.29.0 also adds automatic detection of OIDC credentials for Google Cloud. On Compute Engine, Google Kubernetes Engine (GKE), Cloud Run, Cloud Run functions, App Engine, and Cloud Build, the CLI gets an ID token for the service account of the workload. It then exchanges the ID token for a short-lived Cloudsmith token. The CLI finds the service account through Application Default Credentials (ADC), which is the same mechanism that the Google Cloud client libraries use.

Create an OIDC provider in your Cloudsmith workspace with 

 as the provider URL. Google signs ID tokens for all Google Cloud projects with the same keys, so add claims that match only your own service accounts:

 claim set to the numeric unique ID of the service account. To get the ID, run:

 claim with a wildcard at the start, such as 

. Keep your project ID in the value. A broader value, such as 

, also matches service accounts in other Google Cloud projects.

You can add other claims from the token to limit access further.

: the service account of a virtual machine (VM), a Cloud Run service, or a Cloud Build job.

gcloud auth application-default login --impersonate-service-account=SERVICE_ACCOUNT_EMAIL

. Use them to test the setup from your own machine.

For a step-by-step Cloud Build setup, see 

. For all supported credential types, see 

List packages from connected repositories

Connected repositories let one repository serve the packages of other repositories. v1.29.0 adds 

, so you can see these packages from the terminal:

 column that shows the repository each package belongs to. In JSON output (

 for packages that belong to the repository you listed. The flag works with 

 search queries and the pagination options.

, point to the repository you listed, not to the repository that the package belongs to.

Connected repositories are in early access. To try them, 

 output no longer includes the repository display name

) in the first column instead of the repository display name. The identifier is the value that other CLI commands accept.

The standalone binaries now ship with the Python 3.14 runtime. 

The Python package now requires Python 3.11 or later.

The new detectors use the existing OIDC controls, with the IDs 

 to skip the Google Cloud detector, or use 

 to change the order in which the CLI tries each platform.

For a more detailed list of changes, see the 

CLI v1.29.0: OIDC for Buildkite and Google Cloud, and listing packages from connected repositories

You can now apply cooldown policies to Ruby gem packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny.

You can create cooldown policies via the Cloudsmith API, Terraform provider, and web app.

This feature is available for Ultra and Enterprise customers using policy management with policy as code.

For more information about using cooldown policies, see 

Cooldown policies now support Ruby

A new validate endpoint returns syntax and type errors in Rego policy logic without creating or updating anything, so you can fix them before you submit. The Create and Update endpoints run the same compilation check.

Cloudsmith 

 uses Rego, the declarative policy language from Open Policy Agent (OPA).

The 

: a list describing each problem, with a severity, code, message and, where known, the line it occurs on

: contains the full output from the Rego compiler and is empty when the policy is valid

A policy that compiles returns no findings:

If the policy doesn't compile, the response lists each problem. For example, if line 5 of the policy refers to 

Username and password login on the Cloudsmith CLI stops working on November 20, 2026

Other logs

Mumbai is now a supported storage region

Set exact usage limits with numerical inputs

Proxy and cache packages from your ActiveState Curated Catalog

CLI v1.29.0: OIDC for Buildkite and Google Cloud, and listing packages from connected repositories

Cooldown policies now support Ruby

Validate your policy logic with the Cloudsmith API