Private package repository
Publish packages that only your account can see, and get everything else from pub.dev through the same server. It all works with the dart pub commands you already use.
$ dart pub token add https://private-pub.devRequests to "https://private-pub.dev" will now be authenticated.$ dart pub publishSuccessfully uploaded https://private-pub.dev/packages/my_package version 1.0.0.$ export PUB_HOSTED_URL=https://private-pub.dev$ dart pub get+ my_package 1.0.0+ http 1.6.0Got dependencies!
Set it up once, then publish and install the way you always have.
Sign up once. Your account keeps your packages private, and its page is where you create the token pub uses to reach this server.
Create a token on your account page and paste it when pub asks for it.
dart pub token add https://private-pub.dev
Point a package at this server and publish it as usual. It starts in your personal team, so only its members can see it or install it.
publish_to: https://private-pub.dev
Both ways use the token you added to pub.
Set PUB_HOSTED_URL and every dependency comes from here. Your packages come from your account, and pub.dev packages come through the mirror.
export PUB_HOSTED_URL=https://private-pub.dev
Mark the dependencies that should come from this server with hosted, and the rest keep coming straight from pub.dev. It works for your private packages, and for any pub.dev package you want to go through the mirror.
dependencies:
my_package:
hosted: https://private-pub.dev
version: ^1.0.0
The setup guide covers VS Code, Claude Code, GitHub Actions and Codemagic.
Every package belongs to a team. Anyone signed in who is not on it gets a 404, as if the package never existed. Invite people as readers to let them install it, or as writers to let them publish too. Each of them signs in and uses their own token, and CI uses a service account.
A new package also has to have a name that is free on pub.dev, so a private package is never mistaken for a public one.
The teams guide covers roles, invites, service accounts and team keys.
Public packages come through this server, checked against the checksums pub.dev publishes, so your apps only ever talk to one place.
Search pub.dev from here and open any of its packages next to your own.
How it compares to the other ways to share private Dart packages, and what to expect once you use it.
OnePub is the closest thing to Private Pub. It only does Dart and Flutter, and its site works like pub.dev, with API docs for your packages. The biggest differences are roles and price.
On OnePub, how much control you get over who can publish depends on which plan you pay for. Private Pub has owner, writer and reader roles on every team and every plan, and CI gets service accounts and team keys with a role of their own.
OnePub charges for each member, so the bill grows with every person who joins. On Private Pub a team can have as many members, service accounts and team keys as it needs at no extra cost.
Premium is $10 a month or $100 a year per team, however many people are on it.
Unpub hasn't had a release since November 2022. It finds out who is publishing from a Google sign-in, which dart pub stopped sending to servers other than pub.dev in Dart 2.15, so publishing to it takes workarounds. It only checks who you are when you publish, so anyone who can reach an unpub server can install every package on it. It also needs MongoDB.
Private Pub signs in with dart pub token add, the way pub works with every server that isn't pub.dev. Every package belongs to a team, and everyone who isn't on it gets a 404, on the site and through pub. It runs on Postgres, with packages on disk or in any S3 compatible bucket.
Artifactory, Cloudsmith and Sonatype Nexus are built to hold every kind of artifact a company ships, from Docker images to npm packages. Pub is one format among many there. They store and serve Dart packages, but they don't score them or host their API docs.
Private Pub only does Dart and Flutter, so it can work like pub.dev. Package pages have the README, changelog, example and versions tabs you know, and it can score packages with pana and host the API docs dartdoc makes for them. Uploads get the checks pub.dev makes, from size limits to names that look like other packages.
Cloudsmith does scan packages for known vulnerabilities and malware, which Private Pub doesn't. If your company already runs one of these for everything else, adding pub to it may be simpler. If Dart and Flutter packages are all you need a home for, Private Pub is far less to set up and run.
Git dependencies work, but every machine and CI job that runs dart pub get
needs access to every repo they point at, usually through SSH keys or tokens kept in each CI system. A package in git has no page to browse and no API docs, and nothing checks it before an app starts using it.
On Private Pub, one token per person and one service account per CI system reach every package those teams share. Versions are checked when they're published, the way pub.dev checks them, and a bad version can be retracted so pub stops choosing it unless an app has it locked already.
Not for Dart. GitHub Packages doesn't support pub, and GitLab's request to add it has been open since 2020. The package registries from AWS, Azure and Google Cloud don't support pub either, so teams on those platforms usually fall back to git dependencies.
Private Pub works next to any of them. Keep your code where it is, and publish to Private Pub from the same CI.
No. Private Pub speaks the pub.dev API, so dart pub
and flutter pub
work with it once pub has your token, along with editors and other tools written for pub.dev. The only change is the server a package publishes to.
Your private packages never depend on pub.dev. Packages from pub.dev that your apps already got through this server keep installing too. Their details are refreshed every 10 minutes and served from the cache when pub.dev doesn't answer, and every archive is kept once it's downloaded. Only a package nobody here has used yet has to wait for pub.dev to come back.
CI installs and publishes with a service account, so nobody puts their own token in a CI secret. Add the account to every team the job needs. A team key still works for one team, and it keeps working after whoever made it leaves.
Agents can read every public page as markdown, starting at /llms.txt, and install packages with
dart pub
like anyone else.
Every team starts on Free, with up to 10 packages. Premium is $10 a month or $100 a year per team for unlimited packages and archives up to 500 MB. One subscription covers everyone on the team and all of its keys.