I am an infrastructure provider, CI provider, cloud provider, security vendor, or large platform

Use this path if your service, platform, or infrastructure downloads from Maven Central on behalf of many downstream customers, tenants, workloads, users, or projects.

This is a different situation from a single organization tuning its own builds. Infrastructure providers often do not control the build files, dependency declarations, scanner behavior, container images, or automation patterns their customers bring to the platform. Even when each customer's activity looks reasonable in isolation, the aggregate traffic from the platform can become significant from Maven Central's perspective.

Because rate limits are applied to the traffic Maven Central sees at the network edge, shared egress can cause many unrelated customers or workloads to appear as one high-volume consumer. That can make the problem difficult to solve with configuration changes alone.

If you operate this kind of platform, the right next step is to contact Sonatype so we can understand the traffic pattern and discuss possible solutions together.

Why we need to talk directly

At infrastructure scale, the answer is rarely as simple as "configure a repository manager." The traffic may be shaped by customer workloads, shared runners, hosted build environments, scanners, container pipelines, marketplace integrations, or platform defaults. Some of those patterns may be visible to you; others may only become clear when we compare what your platform sees with what Maven Central sees.

A direct conversation lets us separate ordinary customer activity from platform-level amplification, identify where caching or deduplication may help, and determine whether a technical, operational, or commercial path is needed. Without that context, rate limits are a blunt signal. With that context, we can work toward something more predictable for your platform, your customers, and Maven Central.

Contact us

See 429: Contact support for what to gather and how to reach us. For infrastructure providers, the most important details beyond egress IP are: the type of platform you operate, whether customers share or have dedicated egress, approximate request volume, and any caching or proxying already in place.

We understand that platform-level traffic is more complicated than a single build or a single organization. The goal is to work through it directly rather than forcing guesswork through repeated rate limit blocks.