PHPackages ffraenz/private-composer-installer - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Utility & Helpers](/categories/utility) 4. / 5. ffraenz/private-composer-installer ActiveComposer-plugin[Utility & Helpers](/categories/utility) ffraenz/private-composer-installer ================================== A composer install helper for private packages v5.0.1(5y ago)2331.7M↓11.1%17[2 PRs](https://github.com/ffraenz/private-composer-installer/pulls)5MITPHPPHP ^7.1 || ^8.0 Since Feb 8Pushed 1y ago5 watchersCompare [ Source](https://github.com/ffraenz/private-composer-installer)[ Packagist](https://packagist.org/packages/ffraenz/private-composer-installer)[ GitHub Sponsors](https://github.com/ffraenz)[ RSS](/packages/ffraenz-private-composer-installer/feed)WikiDiscussions main Synced 1mo ago READMEChangelog (9)Dependencies (6)Versions (11)Used By (5) private-composer-installer ========================== [](#private-composer-installer) [![Packagist version](https://camo.githubusercontent.com/6a46b18d8bea265708d7fcaa191748777c1274d2bb560c4bf7e82a3e43a3bf4f/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f66667261656e7a2f707269766174652d636f6d706f7365722d696e7374616c6c65722e7376673f6d61784167653d33363030)](https://packagist.org/packages/ffraenz/private-composer-installer)[![MIT license](https://camo.githubusercontent.com/7013272bd27ece47364536a221edb554cd69683b68a46fc0ee96881174c4214c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d626c75652e737667)](LICENSE.md)[![Build Status](https://camo.githubusercontent.com/1deb8afb2cdd06955a5c4322b199cf66a59188ad595eb9483f8b879e8aefcdab/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f776f726b666c6f772f7374617475732f66667261656e7a2f707269766174652d636f6d706f7365722d696e7374616c6c65722f436f6e74696e756f7573253230496e746567726174696f6e2f6d6173746572)](https://github.com/ffraenz/private-composer-installer/actions)[![Coverage Status](https://camo.githubusercontent.com/e924337164f3852e871678ac65010150d4caf696a2ec2b321cc44429d0735cda/68747470733a2f2f636f766572616c6c732e696f2f7265706f732f6769746875622f66667261656e7a2f707269766174652d636f6d706f7365722d696e7374616c6c65722f62616467652e7376673f6272616e63683d6d6173746572)](https://coveralls.io/github/ffraenz/private-composer-installer?branch=master)[![Packagist downloads](https://camo.githubusercontent.com/e5d797ed9c0d3b10ee7f03c6b695050477312127d2c89e9a8a6ca3c6e091ef7d/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f66667261656e7a2f707269766174652d636f6d706f7365722d696e7374616c6c65722e7376673f6d61784167653d33363030)](https://packagist.org/packages/ffraenz/private-composer-installer) This is a [Composer](https://getcomposer.org/) plugin offering a way to reference private package URLs within `composer.json` and `composer.lock`. It outsources sensitive dist URL parts (license keys, tokens) into environment variables or a `.env` file typically ignored by version control. This is especially useful when you can't use [Private Packagist](https://packagist.com/) or [Basic HTTP Auth](https://getcomposer.org/doc/articles/authentication-for-private-packages.md#http-basic) because the source of a package is not in your control. This repository is inspired by [acf-pro-installer](https://github.com/PhilippBaschke/acf-pro-installer). Quick overview -------------- [](#quick-overview) - This plugin is compatible with both Composer 2.x (latest) and 1.x. - When installing or updating a package, the dist URL `{%VERSION}` placeholder gets replaced by the version set in the package. In Composer 1 the dist URL version gets fulfilled before it is added to `composer.lock`. - Before downloading the package, `{%VARIABLE}` formatted placeholders get replaced by their corresponding environment variables in the dist URL. Env vars will never be stored inside `composer.lock`. - If an environment variable is not available for the given placeholder the plugin trys to read it from the `.env` file in the working directory or in one of the parent directories. The `.env` file gets parsed by [vlucas/phpdotenv](https://github.com/vlucas/phpdotenv). - If an environment variable can't be resolved a `MissingEnvException` gets thrown. - Package dist URLs with no `{%VARIABLE}` formatted placeholders get ignored by this plugin. Examples -------- [](#examples) ### Arbitrary private packages [](#arbitrary-private-packages) Add the desired private package to the `repositories` field inside `composer.json`. Find more about Composer repositories in the [Composer documentation](https://getcomposer.org/doc/05-repositories.md#repositories). Specify the exact version to install, and use `{%VARIABLE}` placeholders to specify any sensitive tokens in your `.env` file. ``` { "type": "package", "package": { "name": "package-name/package-name", "version": "REPLACE_WITH_LATEST_PACKAGE_VERSION", "dist": { "type": "zip", "url": "https://example.com/package-name.zip?key={%PACKAGE_KEY}&version={%VERSION}" }, "require": { "ffraenz/private-composer-installer": "^5.0" } } } ``` Provide the private package dist URL inside the `.env` file: ``` PACKAGE_KEY=pleasedontusethiskey ``` Let Composer require the private package: ``` composer require "package-name/package-name:*" ``` ### WordPress plugins [](#wordpress-plugins) WordPress plugins can be installed using the package type `wordpress-plugin` in conjunction with the `composer/installers` installer. In this example we are installing the ACF Pro plugin. Add following entry to the [repositories](https://getcomposer.org/doc/05-repositories.md#repositories) field inside `composer.json` and set the desired ACF Pro version. ``` { "type": "package", "package": { "name": "advanced-custom-fields/advanced-custom-fields-pro", "version": "REPLACE_WITH_LATEST_ACF_VERSION", "type": "wordpress-plugin", "dist": { "type": "zip", "url": "https://connect.advancedcustomfields.com/index.php?a=download&p=pro&k={%PLUGIN_ACF_KEY}&t={%VERSION}" }, "require": { "composer/installers": "^1.4", "ffraenz/private-composer-installer": "^5.0" } } } ``` Provide the ACF Pro key inside the `.env` file. To get this key, login to your [ACF account](https://www.advancedcustomfields.com/my-account/) and scroll down to 'Licenses & Downloads'. ``` PLUGIN_ACF_KEY=pleasedontusethiskey ``` Let Composer require ACF Pro: ``` composer require "advanced-custom-fields/advanced-custom-fields-pro:*" ``` Configuration ------------- [](#configuration) The configuration options listed below may be added to the root configuration in `composer.json` like so: ``` { "name": "...", "description": "...", "require": { }, "extra": { "private-composer-installer": { "dotenv-path": ".", "dotenv-name": ".env" } } } ``` ### dotenv-path [](#dotenv-path) Dotenv file directory relative to the root package (where `composer.json` is located). By default dotenv files are expected to be in the root package folder or in any of the parent folders. ### dotenv-name [](#dotenv-name) Dotenv file name. Defaults to `.env`. Dependencies ------------ [](#dependencies) This package heavily depends on [vlucas/phpdotenv](https://github.com/vlucas/phpdotenv) to load environment variables "automagically". This may cause version conflicts if your project already depends on it. Refer to this table to set the version of `private-composer-installer` accordingly or consider upgrading. `vlucas/phpdotenv``private-composer-installer``^4.1`, `^5.2``^5.0``^4.0``^4.0``^3.0``^3.0`, `^2.0``^2.2``^1.0`Development ----------- [](#development) Install Composer dependencies: ``` docker-compose run --rm composer composer install ``` Before pushing changes to the repository run tests and check coding standards using following command: ``` docker-compose run --rm composer composer test ``` --- This is a project by [Fränz Friederes](https://fraenz.frieder.es/) and [contributors](https://github.com/ffraenz/private-composer-installer/graphs/contributors) ### Health Score 50 — FairBetter than 96% of packages Maintenance28 Infrequent updates — may be unmaintained Popularity57 Moderate usage in the ecosystem Community26 Small or concentrated contributor base Maturity74 Established project with proven stability Bus Factor1 Top contributor holds 89.1% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~124 days Recently: every ~93 days Total 9 Last Release 2027d ago Major Versions v1.0.2 → v2.0.02019-01-30 v2.0.0 → v3.0.02019-10-22 v3.0.1 → v4.0.02020-02-20 v4.0.0 → v5.0.02020-10-26 PHP version history (4 changes)v1.0.0PHP >=5.5 v1.0.2PHP ^5.6 || ^7.0 v3.0.0PHP ^7.1 v5.0.0PHP ^7.1 || ^8.0 ### Community Maintainers ![](https://www.gravatar.com/avatar/10d71c9da66be80931ef69da92ee0779fd043458844f31ff75c6374c869679ac?d=identicon)[ffraenz](/maintainers/ffraenz) --- Top Contributors [![ffraenz](https://avatars.githubusercontent.com/u/1041468?v=4)](https://github.com/ffraenz "ffraenz (82 commits)")[![GrahamCampbell](https://avatars.githubusercontent.com/u/2829600?v=4)](https://github.com/GrahamCampbell "GrahamCampbell (3 commits)")[![ihorvorotnov](https://avatars.githubusercontent.com/u/1066083?v=4)](https://github.com/ihorvorotnov "ihorvorotnov (2 commits)")[![pierrotevrard-idp](https://avatars.githubusercontent.com/u/57230131?v=4)](https://github.com/pierrotevrard-idp "pierrotevrard-idp (2 commits)")[![szepeviktor](https://avatars.githubusercontent.com/u/952007?v=4)](https://github.com/szepeviktor "szepeviktor (2 commits)")[![macbookandrew](https://avatars.githubusercontent.com/u/784333?v=4)](https://github.com/macbookandrew "macbookandrew (1 commits)") --- Tags acfcomposercomposer-plugindotenvhacktoberfestpackagistwordpressplugincomposerwordpressenvwpprivate ### Embed Badge ![Health badge](/badges/ffraenz-private-composer-installer/health.svg) ``` [![Health](https://phpackages.com/badges/ffraenz-private-composer-installer/health.svg)](https://phpackages.com/packages/ffraenz-private-composer-installer) ``` ### Alternatives [philippbaschke/acf-pro-installer An install helper for Advanced Custom Fields PRO 283724.6k](/packages/philippbaschke-acf-pro-installer)[roots/bedrock WordPress boilerplate with Composer, easier configuration, and an improved folder structure 6.5k441.8k2](/packages/roots-bedrock)[gotoandplay/gravityforms-composer-installer A composer install helper for Gravity Forms 31389.9k](/packages/gotoandplay-gravityforms-composer-installer) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)