One repository URL for Maven and Gradle. Central artefacts come through a pull-through cache that verifies every checksum; your own artefacts publish with a token; the policy gate decides what reaches a build.
The repository goes in the project; the token stays in your user settings file, never in the repository. A catch-all mirror routes every dependency through it.
The placeholders are your base URL and a token from the web UI. The guide covers the same steps for a single project, plain HTTP, verifying the change, and reverting it.
<!-- pom.xml -->
<repositories>
<repository>
<id>dependably</id>
<url>https://repo.example.com/maven/</url>
</repository>
</repositories>
<!-- ~/.m2/settings.xml: the token stays out of the project -->
<servers>
<server>
<id>dependably</id>
<username>user</username>
<password><your token></password>
</server>
</servers>The client sees a registry. Behind it, Dependably Packages stages each upstream artefact and refuses the ones that fail a check you configured.
The Maven guide continues with a verification step, publishing your own packages, and reverting the configuration if you need to.