> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/artifact-registry/use-artifact-registry/manage-registries/upstream-proxy.md).

# Create an upstream proxy

An **Upstream Proxy** in Harness Artifact Registry is a proxy configuration that allows your registry to automatically fetch and cache artifacts from external or remote registries. When a user requests an artifact that isn't available locally, the registry directs the request to the configured upstream proxy, retrieves the artifact, and caches it for future use.

{% hint style="info" %}
**WHY USE AN UPSTREAM PROXY?**

The upstream proxy is essential for caching open-source dependencies. During a build, if a required dependency is not already cached, it is retrieved from a public repository (e.g., Docker Hub or Maven Central) and stored in your Upstream Proxy. This ensures continuous availability, even if the source repository experiences downtime. Harness's caching mechanism enhances reliability and efficiency by reducing dependency on external services and safeguarding access to critical artifacts.
{% endhint %}

### Key benefits <a href="#key-benefits" id="key-benefits"></a>

An upstream proxy provides these benefits:

* **Caching:** Faster access to artifacts by storing them locally once fetched
* **Centralization:** Consolidate external repositories into one location for easier management
* **Access control:** Enforce your security policies while fetching artifacts
* **Reliability:** Reduce dependency on external services by leveraging cached artifacts
* **Automatic scanning:** Artifacts cached through upstream proxies are automatically scanned at ingest time via Supply Chain Security (SCS), not STO

{% hint style="info" %}
**VERIFY YOUR CACHE PATH CONFIGURATION**

An incorrect cache path causes builds to bypass the cache entirely, resulting in significantly longer build times. If your builds are unexpectedly slow, verify the cache path in your upstream proxy settings matches your dependency manager configuration.
{% endhint %}

### Create an upstream proxy <a href="#create-an-upstream-proxy" id="create-an-upstream-proxy"></a>

{% tabs %}
{% tab title="Interactive Guide" %}
{% embed url="<https://app.tango.us/app/embed/e147bc05-70a1-4c65-b828-a12a422898c2>" %}
Creating an Upstream Proxy in Harness Artifact Registry
{% endembed %}
{% endtab %}

{% tab title="Step-by-step" %}
To create an upstream proxy, follow these steps:

1. On the **Registries** tab, select the dropdown next to **+ New Artifact Registry**, then select **Upstream Proxy**.
2. Select a [registry type](/artifact-registry/troubleshooting-and-resources/whats-supported.md#supported-registry-types).
3. Enter the **Upstream Proxy Key**.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>ALLOWED CHARACTERS</strong></p><p>The proxy key must start with a letter and can only contain lowercase alphanumerics, <code>_</code>, <code>.</code> and <code>-</code></p></div>
4. Depending on the registry type, configure the source settings:
5. Choose your **Authentication** method:

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>PUBLIC VS PRIVATE AUTHENTICATION</strong></p><ul><li>Select <strong>Access Key and Secret Key</strong> for private sources</li><li>Select <strong>Anonymous (No credentials required)</strong> for public sources</li></ul></div>
6. Select **Create Upstream Proxy**.
   {% endtab %}
   {% endtabs %}

{% hint style="warning" %}
**HARNESS SECRET MANAGER REQUIRED**

Upstream registry authentication details must be stored in [**Harness Secret Manager**](/harness-ai/use-harness-platform/secrets/secrets-management/harness-secret-manager-overview.md).

External secret managers are not supported for upstream authentication.

This requirement ensures that Harness Artifact Registry can securely decrypt and validate credentials during authentication.
{% endhint %}

### Next steps

Go to [Configure Registries](/artifact-registry/use-artifact-registry/manage-registries/configure-registry.md) to set an upstream proxy for a registry.