> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/integrations/artifactory.md).

# Artifactory integrations

When the only path from your CI pipeline to the public internet runs through your organization's JFrog Artifactory, you can configure Artifactory as a proxy in front of the Seal Artifact Server. Your build authenticates against Artifactory, and Artifactory authenticates against Seal on its behalf.

Two scenarios are covered:

* **Artifact Server deployment method.** The Seal CLI is not in the pipeline. Sealed versions are pinned in your manifests, and each ecosystem's package manager pulls from a JFrog remote that points at the Seal Artifact Server.
* **CLI-driven deployment methods (Remote, Local, or Automatic Remediation).** The Seal CLI runs in the pipeline. With JFrog enabled in the CLI's configuration, the CLI routes both its Seal-Platform backend calls and its sealed-package fetches through JFrog remotes.

The two scenarios share the per-ecosystem JFrog remote configuration. The CLI scenario adds one additional JFrog remote (for the CLI's backend), a JFrog access token, and a small set of environment variables on the CLI.

## Per-ecosystem JFrog remotes

For each ecosystem you seal (npm, Maven, etc.), create a remote in JFrog pointing at Seal's ecosystem endpoint. The per-ecosystem URLs and JFrog repository types follow the same pattern as configuring any other Seal Artifact Server remote. See [Configuring package managers](/setup-apps-os/artifact-server/configuring-package-managers.md) for the per-ecosystem reference; in JFrog these become the corresponding remote-repository configurations.

Authenticate each remote with a Seal artifact-server token. Generate one in the Seal UI; see [Generating tokens](/getting-started/tokens/generating-tokens.md).

In the Artifact Server deployment, this is the whole setup: configure your package managers to pull from the JFrog remotes and the build does the rest.

## JFrog passthrough for the Seal CLI

When the Seal CLI runs in the pipeline, the CLI needs to reach two Seal endpoints: the Seal Platform's CLI backend, and the Seal Artifact Server. With JFrog enabled, both go through JFrog.

### Create the CLI-backend remote in JFrog

In addition to the per-ecosystem remotes above:

* Create a new **Generic** remote repository.
* **Repository Key:** `seal-cli`.
* **URL:** `https://cli.sealsecurity.io/authenticated/jfrog`.
* **User Name:** `jfrog`.
* **Password / Access Token:** the Seal artifact-server token.
* Enable **Propagate Query Parameters**.
* Enable **Disable URL Normalization**.
* Disable **Store Artifacts Locally**.

### Generate a JFrog access token

The Seal CLI authenticates against JFrog with a JFrog token, not the Seal token.

In JFrog, generate a new access token:

* **Token scope:** User.
* **User name:** your user.
* **Expiration:** Never.
* Enable **Create Reference Token**.
* Click **Generate** and copy the reference token.

### Configure the CLI

Two equivalent paths.

**Environment variables:**

```bash
SEAL_JFROG_AUTH_TOKEN=<jfrog reference token>
SEAL_JFROG_INSTANCE_HOST=<your jfrog host, for example domain.jfrog.io>
SEAL_JFROG_ENABLED=true
SEAL_PROJECT=<seal project id>
```

**`.seal-config.yml`:**

```yaml
jfrog:
  host: <your jfrog host, for example domain.jfrog.io>
  token: <jfrog reference token>
  enabled: true
project: <seal project id>
```

Do not include a scheme prefix (no `https://`) on the JFrog host value. The CLI validates the host and will reject a malformed value at startup.

## Related

* [Seal Apps via the Seal Artifact Server](/setup-apps-os/artifact-server.md): the no-CLI deployment scenario.
* [Seal Apps via the Seal CLI in CI/CD](/setup-apps-os/cli-in-cicd.md): the CLI scenario.
* [Configuring package managers](/setup-apps-os/artifact-server/configuring-package-managers.md): per-ecosystem remote URLs.
* [JFrog Artifactory as your remote](/setup-apps-os/artifact-server/jfrog-artifactory.md)