The Buf Schema Registry provides remote packages for Go from modules and plugins using go get, just like any other Go library.

This provides consumers of your API with generated SDKs on demand. With generated SDKs, you no longer need to generate code from Protobuf locally, and thus no longer need for consumers to pull in Protobuf files or perform any generation whatsoever.

The BSR Go module proxy implements the GOPROXY protocol for Buf modules by generating packages on the fly—Go code stubs aren't generated until you request them using go get. Once generated, they are cached, and the cached assets are returned from subsequent requests.

Using Go modules

The key to consuming from the BSR Go module proxy is choosing the right Go module path. The import path for generated Go code has this format:

Go module path syntax

In this example,, the BSR generates code for the connectrpc/eliza module using the connectrpc/go. plugin. This package depends on as well - connect-go has a dependency on code generated by the protocolbuffers/go plugin, and remote packages automatically include plugin dependencies!

Installing packages

To generate the connectrpc/eliza Protobuf module using the connect-go plugin, you could install the generated code like this:

$ go get
go: downloading v1.11.0-20230727062025-d8fbf2620c60.1 go: added v1.11.0-20230727062025-d8fbf2620c60.1

You can use any plugin that generates Go, which can simplify Protobuf workflows down to two steps:

  1. buf push your module to the BSR.
  2. go get your generated Go module.


By default, when you go get a Buf module, the BSR generates code from the most recent reference for the module. But you can also install a specific module version using go get's @ syntax referencing an explicit version or a draft name.


Get the generated asset for the latest version of the module.

$ go get


Get the generated asset for the module at a commit.

$ go get


Get the generated asset for the module at a tag.

$ go get


The BSR supports draft commits. This feature enables you to push unreleased Protobuf file changes and consume generated code without affecting the main branch.

$ buf push --draft dev-draft
$ go get

References with names that contain / are not compatible with the Go remote packages versioning scheme.

Full syntax

Go module version syntax

With package versions (valid semver):

  • The version core is the plugin version 1.11.0
  • The semver pre-release version is composed of:
  • module commit timestamp (YYYYMMDDHHMMSS) 20230727062025
  • module commit short name (12 characters) d8fbf2620c60
  • The final identifier is the plugin revision 1 for the plugin version

Most users will likely use @latest, but if you need to reference a package version explicitly you can do so like this:

$ go get

Private modules

To generate Go code from private modules you'll need to make sure the Go tooling is correctly configured. Begin by logging into the BSR:

$ buf registry login

The go tool authenticates with proxies using .netrc credentials or credentials directly specified in GOPROXY URLs. You can use buf registry login to add BSR credentials to your .netrc file. You can obtain an API token (usable as netrc password) from the Settings page.

        login <USERNAME>
        password <TOKEN>

Or using direct credentials:


Like mentioned in the Go docs on using direct credentials: use caution when taking this approach as environment variables may appear in shell history and in logs.

Private modules are only accessible to authorized users and cannot be pulled through the default module proxy at or have their checksums verified with the public checksum database at To access private modules you need to specify a combination of GOPROXY, GOPRIVATE, GONOPROXY and/or GONOSUMDB.

There are two possible ways to configure go for private modules:

  • Using This implicitly sets GONOPROXY/GONOSUMDB to the same value, causing go to use the direct strategy for fetching directly from BSR without going through the public proxy.

    NOTE: Due to GONOPROXY including the buf registry, this is not compatible with specifying auth directly in GOPROXY. Only netrc based auth is supported in this configuration.

  • Using GOPROXY=,$GOPROXY and This instructs Go to try a module from buf before falling back to the existing configured proxies. This works both for netrc and direct authentication.

Modify the Go environment using the export command in your shell or with the go env -w command to persist the change.


For more information, see the official private modules documentation.

Available plugins

For a full list of supported plugins navigate to the BSR plugins page and search for Go.

To learn more about how these plugins are packaged and distributed check out the bufbuild/plugins repository. If you find a useful plugin that should be added please file an issue!