PSR-1 — Basic Coding Standard

Beginner5 min read·php-12-006

psr

Concept

Composer supports custom repositories for packages not on Packagist — private packages, forks, or local development versions. The repositories key in composer.json specifies additional package sources.

Repository types:

vcs: Install directly from a VCS (Git, SVN, Mercurial) URL. Composer reads the repository's composer.json and branches/tags. Useful for private Git repos, forked packages with custom changes.
path: Install from a local directory. Ideal for monorepos or local development of multiple packages simultaneously. Symlinks are created by default, so code changes are instantly reflected.
package: Define a package inline without a composer.json in the source. Last resort for packages that don't have their own composer.json.
composer (default): Standard Packagist-style repositories (the public Packagist uses this).

Satis: A static Packagist generator. Creates a private Packagist-compatible mirror of specific packages. Useful for organizations that need a private package mirror for air-gapped environments or bundling private packages.

Private Packagist: Commercial hosted service (by the Composer team) for private package repositories with access control.

Authentication: Private VCS repos need credentials. Store in auth.json (next to composer.json, never committed): {"github-oauth": {"github.com": "ghp_TOKEN"}, "http-basic": {"example.com": {"username": "user", "password": "pass"}}}.

Code Example

json

{
    "repositories": [
        {
            "type": "vcs",
            "url": "https://github.com/my-org/private-package.git"
        },
        {
            "type": "vcs",
            "url": "git@github.com:my-org/another-private.git"
        },
        {
            "type": "path",
            "url": "../local-package",
            "options": {
                "symlink": true
            }
        },
        {
            "type": "composer",
            "url": "https://my-satis.example.com"
        }
    ],
    "require": {
        "my-org/private-package": "^1.0",
        "my-org/another-private": "dev-main",
        "my-org/local-package": "*"
    }
}

json

// auth.json — store credentials (NEVER commit this file!)
{
    "github-oauth": {
        "github.com": "ghp_your_personal_access_token"
    },
    "http-basic": {
        "my-satis.example.com": {
            "username": "satis-user",
            "password": "satis-password"
        }
    },
    "gitlab-oauth": {
        "gitlab.com": "your_gitlab_token"
    }
}

bash

# Configure GitHub OAuth token globally (stored in ~/.composer/auth.json)
composer config --global github-oauth.github.com ghp_TOKEN

# Install from local path (development monorepo)
# In packages/my-package/composer.json: { "name": "my-org/my-package", ... }
# In root composer.json: add path repository pointing to packages/my-package
# composer require my-org/my-package:*

# Disable Packagist (use only your own repositories)
composer config repositories.packagist.org false

Previousdev dependencies and the --no-dev flag in productionComposer & PSR Standards NextPSR-12 — Extended Coding StyleComposer & PSR Standards