One repository for Mix and Rebar3, signed with your organization's key. hex.pm packages come through a pull-through cache that verifies every checksum; your own packages publish with a token; the policy gate decides what reaches a build.
Fetch the public key, register the repository, then name it on each dependency that should resolve through it. The Setup page in the web UI shows this with your key filled in.
The placeholders are your base URL and a token from the web UI. The guide covers the same steps for a single project, plain HTTP, verifying the change, and reverting it.
curl -sSf https://repo.example.com/hex/public_key -o dependably-hex.pem
mix hex.repo add dependably https://repo.example.com/hex \
--public-key dependably-hex.pem --auth-key <your token>The client sees a registry. Behind it, Dependably Packages stages each upstream artefact and refuses the ones that fail a check you configured.
The Hex guide continues with a verification step, publishing your own packages, and reverting the configuration if you need to.