The Buf Schema Registry provides remote packages for Go from modules and plugins using
go get, just like any other Go library.
This provides consumers of your API with generated SDKs on demand. With generated SDKs, you no longer need to generate code from Protobuf locally, and thus no longer need for consumers to pull in Protobuf files or perform any generation whatsoever.
The BSR Go module proxy implements the GOPROXY protocol for Buf
modules by generating packages on the fly—Go code stubs aren't
generated until you request them using
go get. Once generated, they are cached,
and the cached assets are returned from subsequent requests.
Using Go modules
The key to consuming from the BSR Go module proxy is choosing the right Go module path. The import path for generated Go code has this format:
In this example,
buf.build/gen/go/connectrpc/eliza/connectrpc/go, the BSR generates
code for the
connectrpc/eliza module using
connectrpc/go. plugin. This
package depends on
buf.build/gen/go/connectrpc/eliza/protocolbuffers/go as well -
connect-go has a dependency on code generated by the
protocolbuffers/go plugin, and remote packages
automatically include plugin dependencies!
$ go get buf.build/gen/go/connectrpc/eliza/connectrpc/goOutputgo: downloading buf.build/gen/go/connectrpc/eliza/connectrpc/go v1.11.0-20230727062025-d8fbf2620c60.1 go: added buf.build/gen/go/connectrpc/eliza/connectrpc/go v1.11.0-20230727062025-d8fbf2620c60.1
You can use any plugin that generates Go, which can simplify Protobuf workflows down to two steps:
buf pushyour module to the BSR.
go getyour generated Go module.
By default, when you
go get a Buf module, the BSR generates code
from the most recent reference for the
module. But you can also install a specific module version using
syntax referencing an explicit version or a draft name.
Get the generated asset for the latest version of the module.
$ go get buf.build/gen/go/connectrpc/eliza/connectrpc/go@latest
Get the generated asset for the module at a commit.
$ go get buf.build/gen/go/connectrpc/eliza/connectrpc/go@d8fbf2620c604277a0ece1ff3a26f2ff
Get the generated asset for the module at a tag.
$ go get buf.build/gen/go/connectrpc/eliza/connectrpc/go@foo
The BSR supports draft commits. This feature enables you to push unreleased Protobuf file changes and consume generated code without affecting the main branch.
$ buf push --draft dev-draft $ go get buf.build/gen/go/connectrpc/eliza/connectrpc/go@dev-draft
References with names that contain
/ are not compatible with the Go remote packages versioning scheme.
With package versions (valid semver):
- The version core is the plugin version 1.11.0
- The semver pre-release version is composed of:
- module commit timestamp (YYYYMMDDHHMMSS) 20230727062025
- module commit short name (12 characters) d8fbf2620c60
- The final identifier is the plugin revision 1 for the plugin version
Most users will likely use
@latest, but if you need to reference a package
version explicitly you can do so like this:
$ go get firstname.lastname@example.org
To generate Go code from private modules you'll need to make sure the Go tooling is correctly configured. Begin by logging into the BSR:
$ buf registry login
go tool authenticates with proxies using
.netrc credentials or
credentials directly specified in GOPROXY URLs.
You can use
buf registry login to add BSR credentials to your
You can obtain an API token (usable as netrc password) from the Settings
machine buf.build login <USERNAME> password <TOKEN>
Or using direct credentials:
Like mentioned in the Go docs on using direct credentials: use caution when taking this approach as environment variables may appear in shell history and in logs.
Private modules are only accessible to authorized users and cannot be
pulled through the default module proxy at https://proxy.golang.org or have
their checksums verified with the public checksum database at
https://sum.golang.org/. To access private modules you need to specify a
There are two possible ways to configure go for private modules:
GOPRIVATE=buf.build/gen/go. This implicitly sets
GONOSUMDBto the same value, causing go to use the
directstrategy for fetching directly from BSR without going through the public proxy.
NOTE: Due to
GONOPROXYincluding the buf registry, this is not compatible with specifying auth directly in
GOPROXY. Only netrc based auth is supported in this configuration.
GONOSUMDB=buf.build/gen/go. This instructs Go to try a module from buf before falling back to the existing configured proxies. This works both for netrc and direct authentication.
Modify the Go environment using the
export command in your shell or with the
go env -w command to persist the change.
$ export GONOSUMDB=$GONOSUMDB,buf.build/gen/go
For more information, see the official private modules documentation.
For a full list of supported plugins navigate to the BSR plugins page and search for Go.