Packages

Depot Packages gives your team a place to publish private packages and install dependencies through Depot with your existing package managers.

Start with the quickstart to create a Private repository and publish a package.

Choose where packages come from

Each repository belongs to your organization and contains one package format. Choose a repository based on what you need:

To create a repository, see manage repositories.

Built-in caches

Depot provides a built-in Cache repository for common public registries, such as npm and PyPI. You can use a built-in cache without creating it. Configure your package manager to use it with the guide for your package manager.

Administrators can change the policies and retention of a built-in cache. They can't change its upstream URL or delete it.

Virtual repositories

A Virtual repository combines Private and Cache repositories of the same format behind one endpoint. Your team can install private packages and upstream dependencies from a single registry URL.

You can also publish through a Virtual repository. Depot stores published packages in a Private source that you choose. To set one up, see combine private and upstream packages.

Share a repository with your team

Every package request requires authentication, including requests to built-in caches. Use your personal Depot login for local development. Your organization role determines what you can do. Members can install and publish; readers can install. Creating repositories and changing their configuration requires owner or administrator access. Every member can use repository setup instructions.

For automation, use an existing Depot job or runner token when available. See authentication and CI before adding credentials to a workflow. To publish from another CI system without a stored token, use trusted publishing.

To combine private and upstream packages, control dependency policies, or manage retention, see manage repositories.