nix-github-api-auth

Configure GitHub access-tokens authentication for nix to resolve API rate limit errors.

2|Updated Jan 2, 2026
One-click install
npx skills add https://github.com/ShineBreaker/Guix-configs --skill nix-github-api-auth-shinebreaker
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: nix-github-api-auth
Source: https://github.com/ShineBreaker/Guix-configs/tree/main/dotfiles/mutable/agents/hermes/.local/share/hermes/skills/devops/nix-github-api-auth
Command: npx skills add https://github.com/ShineBreaker/Guix-configs --skill nix-github-api-auth-shinebreaker

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? When running nix flake update or nix build, unauthenticated requests to api.github.com hit the 60 requests/hour IP rate limit, producing HTTP 403 errors and causing nix to silently fall back to cached flake inputs instead of updating them. ## Core Features & Use Cases - Symptom Diagnosis: Distinguish 403 rate-limit errors (unauthenticated) from 401 Bad credentials errors (invalid or malformed token) in nix output. - Private Token Configuration: Set up access-tokens via a 0600-permission file referenced by NIX_USER_CONF_FILES, keeping tokens out of git repositories and the nix store. - Anti-Pattern Catalog: Avoid documented pitfalls such as the nonexistent file: token syntax, trailing newlines in token files, home-manager pure evaluation blocking builtins.readFile, and misplaced --extra-config flags. - Use Case: Your nix flake update keeps printing "API rate limit exceeded" and "using cached version". This Skill walks you through extracting a token from gh auth token, writing a private nix config, and verifying end-to-end without polluting flake.lock. ## Quick Start Diagnose why my nix flake update shows GitHub API 403 rate limit errors and configure token authentication for it.

Frequently Asked Questions about nix-github-api-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix nix flake update GitHub API rate limit 403 errors?▼

Add a GitHub token to nix via the access-tokens setting, for example `access-tokens = github.com=ghp_xxx` in nix.conf. Authenticated requests raise the limit from 60 to 5000 requests per hour, eliminating the 403 errors.

How to keep GitHub tokens out of nix store and git repositories?▼

Write the token to a private file with 0600 permissions such as ~/.config/nix/gh-token.conf, then point the NIX_USER_CONF_FILES environment variable at it. Remember to also list your regular nix.conf, since setting this variable stops nix from reading the default XDG location.

Why does nix return 401 Bad credentials with a valid GitHub token?▼

A 401 usually means the token reaches GitHub malformed. Common causes are a trailing newline in the token file (nix does not trim whitespace) or using the nonexistent `file:/path` syntax, which nix sends literally as the token string.

Does access-tokens support reading tokens from a file path?▼

No, access-tokens only accepts inline token values like `github.com=ghp_xxx`. The `file:` prefix syntax does not exist for this setting; nix treats the entire string as the literal token, resulting in 401 Bad credentials errors.

Can I inject a GitHub token into home-manager nix settings with builtins.readFile?▼

Not by default, because home-manager switch uses pure evaluation which blocks absolute-path readFile calls. You can pass --impure, but the recommended approach is a private config file referenced through NIX_USER_CONF_FILES instead.