A separate Composer repository per client

Your organization holds all of your packages. For each client, you create a suborganization: a separate Composer repository with its own URL, its own authentication tokens, and only the packages that client's projects need.

Share your agency's reusable packages, like a base theme or your own modules, from the organization into every client's suborganization. Packages that belong to a single client, like a design you built for them or a commercial extension you bought on their behalf, are added only to that client's suborganization. Credentials and mirrored third-party repositories are configured per suborganization too, so each client's Magento Marketplace mirror uses that client's own access keys.

Clients who run Composer themselves can only install what is in their suborganization, never another client's packages. Every plan includes suborganizations, plus one more for each user. See pricing and the suborganization documentation.

Access to Private Packages

Synchronize your packages with GitHub, GitLab or Bitbucket, or add packages from any other Git, SVN or Mercurial repository. Upload zip or tar archives, or define packages as JSON to make them available for Composer installation.

Private Packagist automatically configures webhooks on GitHub, Gitlab or Bitbucket to ensure your package metadata is automatically reloaded as soon as you push code.

Access for Your Team, CI, and Your Clients

Every suborganization comes with a unique Composer URL and authentication tokens for your automated systems, like continuous integration or deployment tools. A token only grants access to its own suborganization.

Team based suborganization access lets you control exactly who works on which client project. Team members use their personal auth tokens, so you can revoke their access in one place when someone leaves your company.

Client developers and freelancers can be added as collaborators to a suborganization. They only get access to that client's repository and won't see your other packages or clients.

Mirroring Third Party Packages

Private Packagist automatically mirrors packages from external sources like Packagist.org to make installs faster and more reliable. You keep a copy of every package your client projects use, so a deploy doesn't fail because a third-party repository is down.

Any Composer repository can be mirrored, for example a vendor's repository when you purchase a package for a client. You keep your copy of the package even when the original source is deleted.