Skip to main content
Last Reviewed: December 13, 2022

Add a Package from a Private Repository

Learn how to add a package from a private repository.

This section provides information on how to add a package from a private repository using Integrated Composer.


Pantheons Secrets Manager is currently in Early Access (EA). You can also use the Terminus plugin to manage your secrets for private repositories in Integrated Composer builds without committing your credentials to the repository. If you use it, follow the instructions in the Terminus plugin README instead of the steps presented on this page.

Add a Package from a Private Repository

The steps below outline a method for adding a package from a private GitHub, GitLab, or Bitbucket repository. Refer to the official Composer documentation for additional information on handling private packages.

A token will be added to your code repository for this procedure. This allows anyone with the token to read and write to private repositories associated with the issuing account. You can explore workarounds to limit the scope of the token access. For example, you can create a new GitHub user and restrict that user's permission to only the private repositories needed for your Composer packages. This ensures your site repository code is not published publicly.

Your repository should contain a composer.json file that declares a package name in its name field. If it is a WordPress plugin or a Drupal module, it should specify a type of wordpress-plugin or drupal-module respectively. For these instructions, we will assume your package name is mycompany/my-private-repo.

  1. Generate a GitHub Personal Access Tokens page. The Github token must have all repo permissions selected.

  2. Add the private repository to composer.json, replacing <token> with your newly generated token.

    "repositories": [
             "type": "vcs",
             "url": "https://<token>"
  3. Run the command below to require the package (you may specify any needed version constraint in this step):

    composer require mycompany/my-private-repo
  4. Run the commands below to commit the updated Composer files and add them to your environment only if the above command update works locally.

    git add composer.json composer.lock
    git commit -m "Adding private package <your-package>"
    git push

More Resources