---
version: "v1.0.5"
category: "bug-fixes"
---

#### Fixed `403 Forbidden` on nested private modules when using the provider cache server

With `TG_PROVIDER_CACHE` enabled, OpenTofu/Terraform sent nested module-registry lookups to the upstream registry with the cache server's API key as the bearer token, instead of the credentials configured for that host. Private registries rejected those requests:

```
Error: Error accessing remote module registry

Failed to retrieve available versions for module "<name>" from
<registry>: error looking up module versions: 403 Forbidden.
```

Terragrunt sets `TF_TOKEN_<host>` to the cache server's API key so the cache can front provider downloads. Module-registry requests bypassed the cache and went straight to the upstream, so the registry saw the cache key instead of the user's token.

The cache server now also fronts the `modules.v1` endpoint for each configured registry. It drops the inbound cache-server bearer, looks up the user's credentials for the upstream host from the loaded CLI config (`TF_TOKEN_<host>`, `~/.terraform.d/credentials.tfrc.json`, etc.), and forwards the request with that token.
