# Connecting External Feeds

Source: https://www.jawsdeploy.net/guides/connecting-external-feeds

Most teams already have an artefact store. Connecting it as an external feed keeps that investment in place.

An external feed is any artefact server Jaws Deploy can pull from. Configuration is one-time: provide the URL, the credentials, the feed type. From then on, deployment steps can reference packages by name and version, and the platform fetches them at deploy time.

## Common external feed types

- **NuGet (any host)**: Public nuget.org, GitHub Packages, MyGet, a self-hosted ProGet. Anything that speaks the NuGet v2/v3 protocol.
- **JFrog Artifactory**: Generic, NuGet, npm, or Maven repos. Authenticate with an API key or username/password.
- **AWS S3**: Treats the bucket as a flat package store. Versioning is by S3 object version or by version in the object key.
- **Azure Artifacts**: Private NuGet, npm, or universal feeds in Azure DevOps. Personal access token or service connection.

> **// Credentials - Use an account scoped to read-only access where possible.**
> 
> Jaws Deploy only needs to *consume* packages from external feeds. Pushing is done from CI, against the credentials CI already holds. A read-only credential limits blast radius if the workspace is compromised.

## Mixed feeds

A single project can pull from both the built-in feed and one or more external feeds. The release locks each package to a specific feed and version when it's created. Promotion across environments uses the same locked references - no risk of pulling a different artefact from a different feed when the release reaches Production.