Hex (Elixir and Erlang)

Point Mix or Rebar3 at your Dependably instance as a Hex repository and mix deps.get or rebar3 get-deps resolves and downloads every package through it: the ones your organization publishes and, on first use, anything from hex.pm. Publishing, retiring and documentation uploads go to the same instance.

You will need your instance's base URL, a token (see Getting started), and the organization's repository public key. Every Hex registry resource is signed, and your client verifies each one against that key, so you register the key along with the URL. The examples below use repo.example.com; substitute your own. Your repository and API URLs are:

https://repo.example.com/hex        # repository (what Mix and Rebar3 resolve from)
https://repo.example.com/hex/api    # API (what publishing talks to)

Register the repository under the name dependably. A Hex client checks that the repository name embedded in every signed resource matches the name it registered. Dependably signs under dependably; a repository registered under any other name fails that check on every fetch.

Configure

Mix

Fetch the public key and register the repository. The Setup page in the web UI shows the same recipe with your instance's URL filled in.

curl -sSf https://repo.example.com/hex/public_key -o dependably-hex.pem
mix hex.repo add dependably https://repo.example.com/hex \
  --public-key dependably-hex.pem --auth-key <your token>
mix hex.repo list

Then name the repository on each dependency that should come from it:

defp deps do
  [
    {:phoenix, "~> 1.7", repo: :dependably},
    {:my_private_lib, "~> 0.3", repo: :dependably}
  ]
end

A dependency that names :dependably resolves through your instance whether it is one your organization published or one Dependably fetches from hex.pm on first use; the lock file records "dependably" as the repository.

Rebar3

Add the repository to Rebar3's global configuration (~/.config/rebar3/rebar.config), with the key's PEM text inline. The Setup page shows this block with your organization's key already filled in.

{hex, [{repos, [
  #{name => <<"dependably">>,
    repo_url => <<"https://repo.example.com/hex">>,
    api_url => <<"https://repo.example.com/hex/api">>,
    repo_key => <<"<your token>">>,
    api_key => <<"<your token>">>,
    repo_public_key => <<"-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----\n">>}
]}]}.

Rebar3 searches repositories in the order listed, before hex.pm, so an ordinary package dependency resolves through Dependably:

{deps, [{decimal, "2.4.1", {pkg, decimal}}]}.

Verify

mix deps.get

With Rebar3, refresh the registry first:

rebar3 update
rebar3 get-deps

Each package downloads through Dependably; a first download of a hex.pm package records an entry on the Activity tab of the Audit log. The package index also carries any vulnerability Dependably has recorded for a release it holds, so a Hex client that reads advisories from the index can report it.

If the repository was registered with the wrong public key, or the key was rotated (below), every fetch fails with a signature error.

Publish

Publishing uses the API URL and a token with the publish:hex capability (the push only preset). Mix reads the URL and token from the environment:

export HEX_API_URL=https://repo.example.com/hex/api
export HEX_API_KEY=<your token>
mix hex.publish --yes

mix hex.publish publishes the package and then its documentation; use mix hex.publish package --yes to skip the docs. The package's name in mix.exs must match the name being published, and the version must be a strict semantic version; a mismatch is refused before anything is stored. Publishing an existing version again is refused unless you pass --replace and your organization allows version overwrite.

With Rebar3, once the repository above carries api_key:

rebar3 hex publish --repo dependably --yes

Retire a release

Retiring marks a release as advised against without removing it, so a project that already locked it keeps resolving. It needs a token with yank:hex, which none of the token presets grant:

mix hex.retire my_private_lib 0.3.1 security --message "CVE-2026-1234"
mix hex.retire my_private_lib 0.3.1 --unretire

Dependably also records the retirement as a deprecation, so an organization that blocks deprecated releases stops serving it.

Revert a release

mix hex.publish --revert 0.3.1 deletes the release, its tarball and its documentation. It needs a token with publish:hex, has no time limit, and is recorded in the audit log. Only releases your organization published can be reverted; a release cached from hex.pm cannot.

The signing key

Every organization has its own registry signing key. The Signatures tab in Settings shows the public key and its fingerprint, and an Admin or Owner can Rotate key there. Rotation takes effect immediately: every developer and CI runner that registered the repository must fetch the new public key and register it again, so treat it as a planned change. If the instance was deployed without a master key (DEPENDABLY_MASTER_KEY), no signing key can be stored and the Hex repository answers 503. Ask your administrator.

Blocked packages

A 403 on a tarball, or a version missing from the index that hex.pm lists, is a policy refusal, not an authentication failure. See Blocked packages. Because Dependably signs the index itself, it leaves out a blocked version it holds, and a hex.pm version your release-age or deprecation policy blocks. Any other block on a version not yet fetched shows up as a 403 on download. The organization's policy is also published as a signed Hex policy resource at https://repo.example.com/hex/repos/dependably/policies/dependably for clients that enforce dependency policies before resolving.