THE PLATFORM / 01
Everything your
packages deserve.
A complete path from private publish to precise package access, for npm, PyPI and plain files, with the client your team already uses.
01 / Publishing
Publishing
The npm CLI workflow your team already knows, hardened for commercial distribution.
Private namespaces
Reserve one scope on the shared registry or run private registries; package names are unique per registry, never claimed globally.
Safe publishes
Reserve, upload, finalize: retries never double-publish, fingerprints reject mismatched content, and committed versions are immutable.
Deprecate and unpublish
Deprecate a version with a message or unpublish it; a tombstone keeps the version from ever coming back.
Dist-tags
Point latest and your own channels at the versions your recipients should get.
02 / Package access
Package access
Give each recipient a key that reaches exactly the packages they need.
Download keys
Choose one or more packages for each read-only key; rotate or revoke access at any time.
Recipients and portal
Group keys under recipients with your own references, suspend on refund, or invite recipients to manage their own keys in a recipient portal.
Issued-to labels
Name the person or integration using a key without creating another account.
Publisher keys
Separate credentials for publishing, narrowed by registry, scope or package.
03 / Delivery
Delivery
Your registry looks and behaves like yours.
Custom domains
Serve a DNS-verified domain — for npm, PyPI or Files — with managed TLS.
Shared registry
Publish under your reserved scope on the platform registry and be installable by default.
Usage metering
Content downloads are measured as transfer, separate from uploads and metadata. Each plan includes a monthly allowance; above it, overage is billed per GB at month close and capped at one month of the plan price unless you change the cap. Downloads never stop.
Transfer ledger
Every download and publish is recorded: who, which package and version, which recipient, when and how many bytes. Filter the ledger by package, recipient and time.
04 / Formats
Formats
npm is the start. Python packages and plain files use the same keys, recipients and domains.
PyPI
Private Python indexes for pip, uv and poetry. Publish with twine. There is no shared namespace: each registry is its own path, so a public name cannot shadow yours.
Files
PUT and GET arbitrary files with curl or wget, or upload and download them from the dashboard. A channel points a name at the version clients should fetch.
- Growth and up
Public npm caching
On Growth and up, installs of public packages can be served through the platform cache. Names you host, and scopes anyone has claimed, never fall through to the public registry. A minimum release age can hide versions that are only hours old.
05 / Workspace and platform
Workspace and platform
The organization around the registry.
Roles and account security
Admins, members and viewers; passkeys and two-factor sign-in on every plan.
- Growth and up
Single sign-on and SCIM
Sign in through your identity provider, verified by email domain, with directory provisioning.
Audit log
Every publish, key and plan change is recorded with actor and time.
- Growth and up
Organization API keys
Use gsk_ keys to automate management of your organization, keys and packages through the Connect API. These keys cannot install or publish npm packages.
- Growth and up
Outgoing webhooks
Package and key events delivered to your endpoints with Standard Webhooks signatures.
Publish with PyPI → Deliver Files → Configure public npm caching →
Compare CloudRepo → Compare JFrog Artifactory → Compare Packagecloud →
READY WHEN YOU ARE