Publishing to NuGet | Fern Documentation

Enterprise feature

This feature is available only for the Enterprise plan. To get started, reach out to support@buildwithfern.com.

Publish your public-facing Fern C#/.NET SDK to the NuGet registry. After following the steps on this page, you’ll have a versioned package published on NuGet. To distribute the SDK internally instead, generate to the local file system (optionally self-hosted) and build a .nupkg with fern generate --package.

Already publishing to NuGet?

If you’re using API key authentication, consider switching to OIDC (trusted publishing). See Migrating from API key to OIDC publishing for the steps.

This page assumes that you have:

An initialized fern folder, a GitHub repository for your C#/.NET SDK, and a C#/.NET target in sdk-config.yml. See Generating an SDK (C#/.NET).

Configure SDK package settings

Update the C#/.NET target in sdk-config.yml to configure the package name and client name for NuGet publishing. Your sdk-config.yml should live in your source repository (or on your local machine), not the repository that contains your C#/.NET SDK code.

Add a unique package name

Your package name must be unique in the NuGet registry, otherwise publishing your SDK will fail.

sdk-config.yml

targets:
  - language: csharp
    package:
      packageName: your-package-name

Configure the client name

The generation.naming.clientName option controls the name of the generated client class.

sdk-config.yml

targets:
  - language: csharp
    package:
      packageName: your-package-name
    generation:
      naming:
        clientName: YourClientName # must be PascalCase

The description, authors, keywords, and repository links on your package’s nuget.org listing come from the target’s package metadata.

Configure GitHub publishing

Fern can automatically publish your SDK to NuGet via GitHub Actions. Set output.delivery to github, configure your repository and publishing mode, and set output.publish.registry to nuget:

Optionally set the mode to control how Fern handles SDK publishing:

mode: release (default): Fern generates code, commits to the default branch (or the branch you specify), and tags a release automatically
mode: pull-request (recommended): Fern generates code and creates a PR for you to review before release
mode: push: Fern generates code and pushes to a branch you specify for you to review before release

You can also configure other settings, like the reviewers or license. Refer to the output.github reference for more information.

sdk-config.yml

targets:
  - language: csharp
    package:
      packageName: your-package-name
    generation:
      naming:
        clientName: YourClientName
    output:
      delivery: github
      github:
        repository: your-org/company-csharp
        mode: push  # or "pull-request"
        branch: your-branch-name  # Required for mode: push
      publish:
        registry: nuget

Configure authentication

Choose how you want to authenticate with NuGet when publishing. OpenID Connect (OIDC) authentication is recommended because it removes the need to manage long-lived API keys.

OIDC authentication (Recommended)

OIDC-based publishing (also known as “trusted publishing”) is the most secure way to publish. With OIDC, you don’t need to manage API keys — NuGet trusts your GitHub repository to publish directly via short-lived tokens scoped to your workflow.

Configure OIDC

sdk-config.yml supports trusted publishing only for npm. To add api-key: OIDC with generators.yml, see Legacy NuGet publishing.

Generate your SDK

Generate your SDK to create the GitHub Actions workflow with OIDC configuration:

fern generate --target csharp

This creates a .github/workflows/ci.yml file configured to use OIDC for NuGet publishing. The generated workflow includes:

A publish job with permissions: { contents: read, id-token: write }
The NuGet/login@v1 action, which exchanges a GitHub OIDC token for a short-lived NuGet API key (~1 hour)
dotnet nuget push using the temporary API key from the login step

Authorize your repository on nuget.org

Configure trusted publishing on nuget.org to allow your GitHub repository to publish:

Go to nuget.org and click your user avatar
Select Trusted Publishing > Create policy
Fill in:
- Repository Owner: Your GitHub organization or username
- Repository: Your C# SDK repository name
- Workflow File: ci.yml (filename only, without the .github/workflows/ prefix)
Choose the policy owner (organization profile or personal account). The policy applies to all packages owned by that profile.

Set the `NUGET_USER` GitHub Actions secret

The generated workflow requires a NUGET_USER secret containing your nuget.org profile name (not your email).

Open your SDK repository on GitHub and go to Settings
Navigate to Secrets and variables > Actions
Click New repository secret
Name it NUGET_USER and enter your nuget.org profile name
Click Add secret

For private repositories, the trust policy starts as temporarily active for 7 days. It becomes permanent after the first successful login binds the repository and owner IDs. Run the publish workflow within that 7-day window.

Troubleshooting

“Unable to authenticate” error

Common causes:

Workflow filename doesn’t match exactly (must be ci.yml)
Trusted publisher configuration on nuget.org doesn’t match your repository settings
A stale NUGET_API_KEY secret is interfering with OIDC authentication

Solution: Double-check your trusted publisher configuration on nuget.org matches your repository name and workflow filename exactly. Remove any old NUGET_API_KEY secret from your repository.

Private repository limitations

For private repositories, the trust policy is temporarily active for 7 days. It becomes permanent after the first successful login. Run the publish workflow within that window.

API key authentication (Legacy)

Generate a NuGet API key

Log into NuGet or create a new account
Click on your profile picture
Select API Keys, then Create
Name your key
Select Push > Push new packages and package versions as the Select Scopes type
Enter * under Select Packages > Glob Pattern

Replacing an existing NuGet package
If you are overriding an existing package, select the relevant package instead of entering *.
Click Create

Save your new key — it won’t be displayed after you leave the page.

Add API key

sdk-config.yml doesn’t have a NuGet credential field yet. To add api-key: ${NUGET_API_KEY} with generators.yml, see Legacy NuGet publishing.

Add `NUGET_API_KEY` as a GitHub Actions secret

Open your repository on GitHub and go to Settings
Navigate to Secrets and variables > Actions
Click New repository secret
Name it NUGET_API_KEY and paste your NuGet API key
Click Add secret

Publish your SDK

Your SDK will automatically be published to NuGet when you create a GitHub release with a version tag:

Create a GitHub release with a version tag (for example, v1.0.0)
The CI workflow will run automatically and publish to NuGet
View your package on nuget.org to confirm the version

Alternative: Manual workflow dispatch

If you prefer to trigger publishes manually from your source repository, set up a release workflow via GitHub Actions.

Add secret for your Fern API key

Open your source repository on GitHub and go to Settings
Navigate to Secrets and variables > Actions
Select New repository secret
Name your secret FERN_TOKEN
Add your Fern API key. If you don’t already have one, generate one by running fern token. By default, the API key is generated for the organization listed in fern.config.json.
Click Add secret

If you use API key authentication, also add a NUGET_API_KEY secret with your NuGet API key.

Set up a new workflow

Create a CI workflow that you can manually trigger from the GitHub UI. Navigate to Actions > New workflow > Set up workflow yourself:

.github/workflows/publish.yml

name: Publish C#/.NET SDK
on:
  workflow_dispatch:
    inputs:
      version:
        description: "The version of the C#/.NET SDK that you would like to release"
        required: true
        type: string
jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
      - name: Install Fern CLI
        run: npm install -g fern-api
      - name: Release C#/.NET SDK
        env:
          FERN_TOKEN: ${{ secrets.FERN_TOKEN }}
          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }} # Only needed for API key authentication
        run: |
          fern generate --target csharp --version ${{ inputs.version }} --log-level debug

Regenerate and release your SDK

Navigate to the Actions tab, select the workflow, specify a version number, and click Run workflow. This regenerates your SDK.

The rest of the release process depends on your chosen mode:

Release mode (default): If you didn’t specify a mode or set mode: release, no further action is required. Fern automatically tags the new release with your specified version number and initiates the publishing workflow in your SDK repository.
Pull request or push mode: If you set mode: pull-request or mode: push, Fern creates a pull request or pushes to a branch respectively. Review and merge the PR (pull-request) or branch (push), then tag a new release to initiate the publishing workflow in your SDK repository.

Once the workflow completes, view your new release by logging into NuGet and navigating to Manage Packages.

Alternative: Release via CLI and environment variables

Set NuGet environment variable

If you use API key authentication, set the NUGET_API_KEY environment variable on your local machine:

export NUGET_API_KEY=your-actual-nuget-api-key

Regenerate and release your SDK

Regenerate your SDK, specifying the version:

fern generate --target csharp --version <version>

The rest of the release process depends on your chosen mode:

Release mode (default): If you didn’t specify a mode or set mode: release, no further action is required. Fern automatically tags the new release with your specified version number and initiates the publishing workflow in your SDK repository.
Pull request or push mode: If you set mode: pull-request or mode: push, Fern creates a pull request or pushes to a branch respectively. Review and merge the PR (pull-request) or branch (push), then tag a new release to initiate the publishing workflow in your SDK repository.

Once the workflow completes, view your new release by logging into NuGet and navigating to Manage Packages.

Migrating from API key to OIDC publishing

Migrating to OIDC publishing uses generators.yml. See Migrating from API key to OIDC publishing in the Legacy docs.

Configure SDK package settings

Add a unique package name

Configure the client name

Configure GitHub publishing

Configure authentication

OIDC authentication (Recommended)

Configure OIDC

Generate your SDK

Authorize your repository on nuget.org

Set the NUGET_USER GitHub Actions secret

Troubleshooting

API key authentication (Legacy)

Generate a NuGet API key

Add API key

Add NUGET_API_KEY as a GitHub Actions secret

Publish your SDK

Alternative: Manual workflow dispatch

Add secret for your Fern API key

Set up a new workflow

Regenerate and release your SDK

Alternative: Release via CLI and environment variables

Set NuGet environment variable

Regenerate and release your SDK

Migrating from API key to OIDC publishing

Set the `NUGET_USER` GitHub Actions secret

Add `NUGET_API_KEY` as a GitHub Actions secret