> ## Documentation Index
> Fetch the complete documentation index at: https://developer.upsun.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticated Composer repositories

> Allow Composer to authenticate against a private third-party Composer repository and download PHP packages from it.

> [!TIP]
>
> You can now use composable image to install runtimes and tools in your application container. To find out more, see the [Composable image](https://developer.upsun.com/docs/configure-apps/app-reference/composable-image.md) topic.

[Packagist](https://packagist.org/) is the primary Composer repository for public PHP packages.
But you can also have Composer download PHP packages from a private, third-party Composer repository.
To make sure Composer has the necessary credentials to do so,
follow the instructions on this page.

## Before you begin

You need:

* An Upsun Cloud project using [PHP](https://developer.upsun.com/docs/languages/php) and Composer
* Credentials to access a private third-party Composer repository
* The [Upsun Cloud CLI](https://developer.upsun.com/cli.md)

## 1. Declare a private Composer repository

To allow Composer to download packages from a private third-party repository,
declare the repository in your Composer setup.


    \{
        "repositories": \[
            \{
                "type": "composer",
&#x20;               "url": "https\://\<PRIVATE\_REPOSITORY\_URL>"
&#x20;           }
&#x20;       ]
&#x20;   }
&#x20;&#x20;

## 2. Set up Composer authentication using a variable

To allow Composer to successfully authenticate when accessing the declared private repository,
set an [`env:COMPOSER_AUTH` variable](https://developer.upsun.com/docs/development/variables) for your project.

To do so, run the following command:


&#x20;   upsun variable:create --level project --name env:COMPOSER\_AUTH&#x20;
&#x20;     \--json true --visible-runtime false --sensitive true --visible-build true&#x20;
&#x20;     \--value '\{"http-basic": \{"\<PRIVATE\_REPOSITORY\_URL>": \{"username": "\<USERNAME>", "password": "\<PASSWORD>"}}}'
&#x20;&#x20;

The [`env:` prefix](https://developer.upsun.com/docs/development/variables#top-level-environment-variables) means that the variable is exposed
as its own Unix environment variable.
The `--visible-runtime false` and `--visible-build true` flags mean the variable is available to Composer only during the build.

## 3. Clear your project's build cache

For security reasons, make sure that the authentication credentials aren't cached in your project's build container.
To do so, run the following command:

```bash theme={null}
upsun project:clear-build-cache
```

## Access dependencies downloaded from a private repository

When you download a dependency from a private third-party Composer repository,
that dependency is usually hosted in a [private Git repository](https://developer.upsun.com/docs/development/private-repository.md).
Access to private Git repositories is restricted through the use of SSH keys.
But most private Composer tools mirror tagged releases of dependencies
and serve them directly without hitting the Git repository.
To avoid having to authenticate against a remote Git repository,
make sure your dependencies specify tagged releases.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.