Cargo packages

Use Depot as an alternative Cargo registry or replace crates.io downloads with the built-in crates-io cache.

Configure with the Depot CLI

Run depot packages configure to add a registry named depot to your Cargo home configuration, ~/.cargo/config.toml by default:

depot packages configure cargo --org <org-id> --repository crates-io

Cargo gets the current token from the Depot CLI through the cargo:token-from-stdout credential provider, which requires Cargo 1.79 or later. Add --auth store to save a token in Cargo's credentials file instead.

For the built-in crates-io cache, the command also replaces crates.io with the depot registry. For other repositories, use --registry depot, or add --replace-upstream when the repository includes crates.io.

Connect Cargo

In .cargo/config.toml, add an alternative registry:

[registries.depot]
index = "sparse+https://packages.depot.dev/<org-id>/cargo/team/index/"
credential-provider = ["cargo:token"]

Keep the sparse+ prefix and trailing slash. Set DEPOT_TOKEN, then supply it to Cargo:

export CARGO_REGISTRIES_DEPOT_TOKEN="$DEPOT_TOKEN"
cargo add serde --registry depot
cargo build

To route existing crates.io dependencies through a Cache or Virtual repository that includes crates.io, add source replacement:

[source.crates-io]
replace-with = "depot"

[source.depot]
registry = "sparse+https://packages.depot.dev/<org-id>/cargo/team/index/"

Source replacement expects the replacement to contain the original source's crates. Don't replace crates.io with a Private repository. See Cargo source replacement.

Publish a crate

Change the registry URL above to a Private repository or writable Virtual repository, then publish:

cargo publish --registry depot

You can restrict your crate's publish destination in Cargo.toml:

[package]
name = "widget"
version = "1.0.0"
publish = ["depot"]

Cargo reads CARGO_REGISTRIES_DEPOT_TOKEN through cargo:token. In CI, use the injected Depot credential. See Cargo registry authentication.

Publish from CI with trusted publishing

rust-lang/crates-io-auth-action can get a short-lived Depot token for cargo publish without a stored token. Add a trust policy to the Private repository first. See trusted publishing for Cargo.