Consuming crates

Every registry speaks the cargo sparse index protocol. Reads require a token by default — a public registry is not an anonymous one. The owner of a public publish registry may open an anonymous downloads lane (registry Settings → Anonymous access), and then the index, downloads and search answer credential-less requests; the traffic is throttled per client network and metered against the owning org. Mirrors are excluded, and cargo is only told authentication is optional ("auth-required": false) when the registry has no compliance policy configured — under a policy, per-caller views differ and cargo would stop sending your token, silently dropping held-version scopes, per-package grants and the publish echo.

Consumers only ever see promoted versions (unless their token carries the any-version flag; see Tokens & access).

As a named registry

The standard setup, for publish registries and for mirrors of registries other than crates.io:

[registries.acme]
index = "sparse+https://haven.example.com/r/acme/index/"

[registry]
global-credential-providers = ["cargo:token"]

Dependencies then name the registry explicitly:

[dependencies]
useful-crate = { version = "2", registry = "acme" }

As a crates.io replacement

A mirror registry whose upstream is crates.io can replace cargo’s built-in source, so plain dependencies resolve through your mirror with zero Cargo.toml changes:

[registries.acme-mirror]
index = "sparse+https://haven.example.com/r/acme-mirror/index/"

[source.crates-io]
replace-with = "acme-mirror"

[registry]
global-credential-providers = ["cargo:token"]

Every serde = "1" in the project now goes through the mirror and its policy. The registry page shows the right snippet for its kind, filled in with real URLs.

Public registries

Public registries are browsable by any signed-in user, and their promoted versions can be pulled with a personal public-read token: mint one from your account, it reads promoted versions of every public registry on the instance. This is how open source distributed through Haven is consumed.

Private access across organizations

To let an outside identity read a private crate, the registry owner adds a grant for it. The consumer then uses their own token; the grant, not the token, is what entitles them.