what is the best way to install private plugin in Craft CMS 3? The private plugin is installed in private GitHub repo, but we don't have a custom packagist that we would use, therefore I wonder if there is any option to enable private plugins via composer/plugin-installer?

  • You can use private repositories with Composer. The documentation provides an example: getcomposer.org/doc/… Apr 21, 2017 at 16:24
  • will it work with plugin-installer? What is the difference between installing via composer and plugin-installer?
    – PeterBocan
    Apr 21, 2017 at 16:28

3 Answers 3


I haven't done this with Craft, but with another Laravel project I was able to add a package from a private repo as follows:

1) In composer.json, after the require array, add a new repositories array:

"require": [
"repositories": [
   "type": "git",
    "url": "https://github.com/YOURGITHUBNAME/your-repo.git"

2) In the "require" array, add your package:

"require": [
  "YOURGITHUBNAME/your-repo": "*",

3) Here's the under-documented trick you need to do to get it all working: you must create a "release" in github, and the release name must be the letter "v" followed by the version number (e.g. v1.0.0). So go to your repo, click the "Releases" link, then click the "Draft a new release" button. It asks for a tag version and a Release title... I can't remember which of these is the critical one, so just put v1.0.0 into both of these fields.

4) Now if you run composer install it should (hopefully) bring in your private repo package. Might need to provide some kind of authorization / API key to access it if it's a private repo (I'm not sure how exactly this works, but should be fairly easy to find documentation on).

  • Technically, your third point is incorrect. In Git, a tag is just an annotated pointer to a commit; in other words, it's a convenient name that you can use to refer to a specific commit hash. As such, you can refer to the hash directly: "require": {"vendor/package": "dev-master#ed7fa4b0"}. That said, it's preferable to use version numbers, where possible. More details here: getcomposer.org/doc/04-schema.md#package-links Apr 21, 2017 at 22:18
  • 1
    "Preferable" to use version numbers is an understatement! From the docs: Note: This feature has severe technical limitations, as the composer.json metadata will still be read from the branch name you specify before the hash. You should therefore only use this as a temporary solution during development to remediate transient issues, until you can switch to tagged releases. The Composer team does not actively support this feature and will not accept bug reports related to it.
    – Jordan Lev
    Apr 21, 2017 at 23:01
  • Like I said, your third point is technically incorrect. Apr 21, 2017 at 23:33

Typically, the desire for a private plugin is for a one-off client project, where the client owns the custom plugin. If that's the case here, I'd consider just changing the plugin over to be a module, and making it part of the project itself (checked into git, and all that).

e.g.: Enhancing a Craft CMS 3 Website with a Custom Module

It's actually pretty easy to convert a plugin over to being a module. FWIW!

  • You just nailed my use case. Thank you! Apr 15, 2019 at 11:21

In addition to the git repository type, "private" plugins can also use Composer's path repository feature to achieve this:



  • well, actually I want to use composer. I am not sure, how to incorporate the plugin into current codebase. Adding a repo into a composer.json should be enough, right?
    – PeterBocan
    Apr 21, 2017 at 18:11
  • @bradbell did this ever actually happen? Jul 23, 2018 at 16:53
  • Updated my answer... had misunderstood the original question, I suppose.
    – Brad Bell
    Jul 23, 2018 at 19:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.