rcknr/composer-auth-dotenv

A composer install helper for private packages

dev-main 2025-05-06 15:13 UTC

Requires

• php: ^8.0
• composer-plugin-api: ^2.0
• vlucas/phpdotenv: ^5.2

Requires (Dev)

• composer/composer: ^2.0
• donatj/mock-webserver: ^2.7
• laminas/laminas-coding-standard: ^2.0
• symfony/phpunit-bridge: ^5.1
• symfony/process: ^5.1

MIT

• Sergii Kauk

• plugin
• composer
• auth
• env
• dotenv

README

This Composer plugin lets you store credentials for private packages in a .env file, using the same format as the COMPOSER_AUTH environment variable. This approach avoids using auth.json, keeps credentials out of version control, and makes them easier to manage and encrypt alongside other environment-specific configuration. This repository is inspired by private-composer-installer.

Motivation

In Laravel ecosystem there are many commercially distributed packages that require authentication to be installed. The usual way to authenticate is to use the auth.json file, which is then ignored (or not) by version control. It is more practical, however, to be able to store credentials in a .env file, which is already used for other environment-specific configuration. The .env file can be encrypted and decrypted using the php artisan env:encrypt and php artisan env:decrypt commands. The encryption key can be shared with team members to securely grant access to all necessary project secrets. This might make it easier and safer to manage composer credentials in your development team.

Setup

• Add the desired private package to the repositories section inside composer.json. Find more about Composer repositories in the Composer documentation.
• Configure authentication using composer config. This will create an auth.json file. Different supported options are described in the Composer documentation
• Convert auth.json content to COMPOSER_AUTH environment variable format and append it to your .env file:

echo -n "COMPOSER_AUTH=" >> .env && cat auth.json | tr -d '\n[:space:]' >> .env

Configuration

The configuration options listed below may be added to the extra section of composer.json like so:

{
  "name": "...",
  "description": "...",
  "require": {
  },
  "extra": {
    "composer-auth-dotenv": {
      "dotenv-path": ".",
      "dotenv-name": ".env"
    }
  }
}

dotenv-path

Dotenv file directory relative to the root path (where composer.json is located). By default, dotenv files are expected to be in the root folder.

dotenv-name

Dotenv file name. Defaults to .env.