A Composer plugin that replaces sensitive tokens in private package URLs with environment variables, keeping secrets out of version control.
private-composer-installer is a Composer plugin that enables secure installation of private packages by extracting sensitive keys and tokens from package URLs into environment variables. It prevents exposing credentials in `composer.json` or `composer.lock` files, making it ideal for projects that rely on private dependencies without using services like Private Packagist.
PHP developers and teams managing Composer-based projects that need to securely include private packages from sources they don't control, such as proprietary WordPress plugins or third-party libraries requiring license keys.
Developers choose this plugin because it provides a security-first approach to secret management by ensuring credentials never reside in version-controlled files, offers seamless integration with environment variables and .env files, and works with both Composer 1.x and 2.x without requiring services like Private Packagist.
Composer install helper outsourcing sensitive keys from the package URL into environment variables
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Prevents sensitive keys from appearing in composer.json or composer.lock by using environment variable substitution, adhering to security-first principles as stated in the README.
Automatically loads variables from .env files using vlucas/phpdotenv, simplifying configuration without manual environment setup, as highlighted in the dotenv integration feature.
Works with both Composer 1.x and 2.x, ensuring support for legacy and modern setups without requiring upgrades, per the compatibility note.
Only processes URLs with {%VARIABLE} placeholders to avoid overhead, and automatically replaces {%VERSION} with the package version during installation, as described in the selective processing feature.
Heavily depends on vlucas/phpdotenv, which can lead to compatibility issues if the project uses a different version, requiring careful version matching as shown in the dependencies table.
Requires adding verbose package definitions to composer.json for each private dependency, which is more complex and error-prone than using standard Composer repositories or services.
Only supports package dist URLs with placeholders, not other authentication methods or source repositories, restricting flexibility for diverse package sources.
Private-Composer-Installer is an open-source alternative to the following products: