Private Pub
Sign up

Changelog

What has shipped

Newest first. Each entry is a change you can use today.

For agents and LLMs: this page as markdown or llms.txt

October 13, 2026

Service accounts

Create a machine principal (e.g. GitHub Actions), give it reader or writer on any teams you own, and use one sa_ token in CI: dart pub token add https://your-root-url --env-var PRIVATE_PUB_TOKEN.

  • Existing team keys keep working. Owners can convert a key without changing the secret already in CI.

October 13, 2026

Private Pub is public

Publish Dart and Flutter packages that only your team can install, with the dart pub commands you already use.

  • Packages belong to a team. Anyone who is not on it gets a 404, on the site and from dart pub, as if the package did not exist.
  • pub.dev packages can come through the same server. Each archive is checked against the checksum pub.dev publishes before it is kept.
  • Stock dart pub is enough. Add a token with dart pub token add, set publish_to to publish, and mark a dependency hosted to install it.
  • Teams have owner, writer and reader roles. Owners run the team, writers publish, and readers install.
  • Each person creates their own token on the account page. It stays there, so they can copy it again, and replace it if it leaks.
  • CI uses a team key instead of a personal token. A reader key installs the team's packages, and a writer key can publish.
  • A new package name has to be free on pub.dev. Names that only look like one already taken are rejected too, so a private package can't be mistaken for a public one.
  • The setup guide covers Claude Code, and /llms.txt tells other agents how the server works.
  • Every team starts free, with up to 10 packages. Premium is $10 a month or $100 a year per team, for unlimited packages, however many people are on it.