Fix it fast
Most likely: RepoFlow rejected the module request because the runner credential is missing, invalid, under-scoped, or blocked by policy.
Confirm this is your error
Match the output and confirm you are troubleshooting the same failure.
go: corp.example.com/team/lib@v1.2.3: reading https://packages.example.com/go/corp.example.com/team/lib/@v/v1.2.3.info: 401 Unauthorized
go: corp.example.com/team/lib@v1.2.3: reading https://packages.example.com/go/corp.example.com/team/lib/@v/v1.2.3.zip: 403 ForbiddenCheck the cause
Run focused checks to identify what is failing in this environment.
go version
go env GOPROXY
go env GOAUTH # Go 1.24+ only
go mod download -x <module>@<version>Apply the safe fix
Use the smallest safe change that addresses the confirmed cause.
# For http://, move the proxy to HTTPS first; GOAUTH is HTTPS-only.
# Configure .netrc/NETRC or GOAUTH without putting secrets in this command.
# Keep the intended RepoFlow URL in GOPROXY.Verify it works
Repeat the relevant checks and confirm the original error is gone.
go mod download -x <module>@<version>
go build ./...Avoid unsafe shortcuts
Keep security and data protections in place while troubleshooting.
- Do not commit credentials inside a GOPROXY URL.
- Do not switch to
director pipe fallback before confirming whether the 403 is an intentional policy decision.
What This Error Means
Read this as a precise clue about which part of the workflow broke first. Once you know the failing layer, the fix path gets much shorter.
How to Fix It
The fastest fixes here come from checking the immediate failing layer before you change anything unrelated. Make one correction at a time and re-test from the same environment.
HTTP proxy:expose it over HTTPS before configuring credentials.
Missing credential:configure secret-backed .netrc, NETRC, or Go 1.24+ GOAUTH credentials for the HTTPS proxy host.
Missing permission:grant the automation identity the narrow read scope it requires.
Policy denial:change the dependency or update the reviewed server-side policy. Do not silently route around it.
Wrong proxy URL:correct GOPROXY so the request targets the intended RepoFlow endpoint.
Fallback:use pipes only if policy permits bypass after any proxy error.
Why It Happens
There are usually a few repeatable root causes behind this message. Narrowing them down early prevents a lot of trial-and-error.
The proxy uses HTTP, so Go does not apply GOAUTH credentials to the request.
The credential is missing, expired, or configured for the wrong hostname.
A .netrc entry includes a URL or path, or a GOAUTH helper returns credentials for the wrong URL.
The authenticated identity lacks access to this repository or module namespace.
RepoFlow denies the module through an allowlist, security, or license policy.
Verify the Fix
Repeat go mod download -x <module>@<version> and confirm RepoFlow serves the module, and run the original build and verify that no fallback reaches an unapproved public proxy or direct VCS origin.
Confirm the failing host and proxy fallback policy
Run go version and go env GOPROXY. On Go 1.24+, also inspect go env GOAUTH.
Use go mod download -x <module>@<version> to confirm the failing host is RepoFlow, not Git or sum.golang.org.
If the failing proxy URL uses http://, move it to HTTPS before configuring credentials. Go does not apply GOAUTH to HTTP requests.
For HTTPS, inspect .netrc, NETRC, or GOAUTH for the exact hostname without printing secrets. Distinguish bad credentials from a permission or policy denial.
How Go handles an authenticated proxy response
Go requests module endpoints from the proxies in GOPROXY. With commas, only HTTP 404 or 410 permits fallback, so 401 and 403 are terminal. Pipe separators allow fallback after any error, which may bypass an intentional security or license-policy denial.
Prevent It From Coming Back
To prevent this, standardize one proxy-auth pattern per supported Go version, monitor proxy 401 and 403 responses separately so credential failures are not confused with policy denials, and document comma-versus-pipe semantics beside the organization’s canonical GOPROXY value.
Docs and source code
Go module proxy selection source
Current implementation of GOPROXY order, comma fallback, pipe fallback, and 404/410 handling. - Source
Pipe entries fall back on any error. Comma entries fall back only when the response is not found.Managing Dependencies
Official task guidance for dependency changes and GOPROXY comma-versus-pipe fallback behavior. - Source
Comma-separated proxies fall through on 404 or 410. Pipe-separated proxies fall through on any error.go command documentation
Current command and environment-variable reference, including GOAUTH and module-aware commands. - Source
The go command provides module, workspace, environment, build, list, get, and install operations.Go Modules Reference
Official reference for module files, version selection, proxies, private modules, checksums, workspaces, and vendoring. - Source
The go command uses module paths and versions to resolve, download, and authenticate dependencies.