Sonatype now require an API KEY

[soljian]

Precondition

• I checked the issues list for existing open or closed reports of the same problem.

Describe the bug
A scan would not run anymore as Sonatype is requiring an API KEY right now in order to proceed.
All of our scans were running well last week.

Version of dependency-check used
Using the owasp/dependency-check:latest docker image

Log file

[ERROR] Error initializing OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required

[Maulinuxops]

Support for authentication to https://ossindex.sonatype.org/ reportedly added in v12.1.5

PLEASE consider adding an example to demonstrate how to pass Sonatype OSS credentials. There is no "ossIndexAnalyzerToken" parameter, only ossindexServerId which is definitely NOT self-explaining

[Maulinuxops]

Please also specify whether Sonatype OSS data is a new feature (by disabling it via the ossindexAnalyzerEnabled everything will work just as it used to) or we'll miss something without a Sonatype account

[limkinZero]

I put the file settings.xml in .dependency-check folder with the the following xml and not working

<settings>
  <ossindex>
    <username>myuser</username>
    <token>mytoken</token>
  </ossindex>
</settings>

Is anyone using this successfully? Is it possible to use an environment variable instead of having to hardcode the token?

[chadlwilson]

See https://github.com/dependency-check/DependencyCheck/blob/main/CHANGELOG.md#version-1215-2025-09-20 and #7920

PLEASE consider adding an example to demonstrate how to pass Sonatype OSS credentials. There is no "ossIndexAnalyzerToken" parameter, only ossindexServerId which is definitely NOT self-explaining

The ability to set OSSIndex credentials has been there for a while.

CLI
https://dependency-check.github.io/DependencyCheck/dependency-check-cli/arguments.html

• the settings you want are --ossIndexUsername and --ossIndexPassword

Maven

• the settings you want are ossIndexUsername and ossIndexPassword (or ossIndexServerId if you want to keep these values in your maven settings.xml)
  https://dependency-check.github.io/DependencyCheck/dependency-check-maven/configuration.html

Gradle

• the settings you want are analyzers.ossIndex.username and analyzers.ossIndex.password
  https://dependency-check.github.io/DependencyCheck/dependency-check-gradle/configuration.html

edit: fixed links

Please also specify whether Sonatype OSS data is a new feature (by disabling it via the ossindexAnalyzerEnabled everything will work just as it used to) or we'll miss something without a Sonatype account

It is not a new feature, it has been enabled by default for years.

Is anyone using this successfully?

It's working via Gradle plugin fine for me.

Is it possible to use an environment variable instead of having to hardcode the token?

You can use an environment variable the same way you inject any value from an environment variable into Maven, generally using standard ${ENV_VAR} syntax.

[Maulinuxops]

Maven

* the settings you want are `ossIndexUsername` and `ossIndexPassword`
  https://jeremylong.github.io/DependencyCheck/dependency-check-maven/configuration.html (_missing from docs_ at time of writing)

Yes, missing. That was the page I looked at.

Thanks.

[jenspopp]

Since this is moving to be a paid service with rate limits, is there a way to cache as with NVD (I mean centrally, not in the project/or on a specific machine, I've seen the ossindexAnalyzerUseCache)? Or what is the effect of disabling the plugin?

[jeremylong]

You are looking at the old documentation site. The username and password are documented:

• Maven: https://dependency-check.github.io/DependencyCheck/dependency-check-maven/configuration.html
• Gradle: https://dependency-check.github.io/DependencyCheck/dependency-check-gradle/configuration.html

[jeremylong]

As with most of the private databases out there - they have a few vulnerabilities that are not listed in the NVD. By disabling the OSS Index analyzer, you won't have access to these vulnerabilities.

Regarding the cache, yes, it caches responses for 24 hours by default.

[soljian]

What about the docker image ? Is there any env var that we could inject or something ?

[jeremylong]

docker image is the same as the cli.

[soljian]

Alright thanks it's working with these arguments :

--ossIndexUsername $USERNAME
--ossIndexPassword $PASSWORD

Please consider update the docker hub documentation as the authentication is now mandatory

[chadlwilson]

@jeremylong ugh. There is no indication here that it's outdated and this is what google will commonly still take you to. can the docs be unpublished and leaving behind just the bare minimum stuff for functionality rather than leave stale stuff up?

[jeremylong]

I'll look into putting some form of deprecated message with a link to the proper site on each page...