Using a Composer with private GitHub repos over HTTPS

Question

We have a number of private repositories which we would like to include in a PHP application using Composer. The composer.json file contains this entry which defines our first private repository:

"repositories": [
    {
        "type": "vcs",
        "url": "https://github.com/vendor/package.git"
    }
]

We then require the repository like normal:

"require": {
    "vendor/package": "~1.0.0"
}

The only extra thing I have done is set a private access token up on GitHub and store it in composers auth.json file. That looks like:

{
    "github-oauth": {
        "github.com": "<my_access_token>"
    }
}

Everything looks like it's been setup correctly for Composer to access GitHub via HTTPS with the access token, but we're getting errors which look like this:

[RuntimeException]
Failed to clone https://github.com/vendor/package.git via https protocols, aborting.
 - https://github.com/vendor/package.git
   Cloning into bare repository '/home/vagrant/.composer/cache/vcs/https---github.com-vendor-package.git'...
   remote: Invalid username or password.
   fatal: Authentication failed for 'https://github.com/vendor/package.git/'

The access token is valid, because I have used it to get past the rate limit exceeded message you often see and it's showing up on GitHub as being recently used.

Have we missed out a step here? Ideally we'd like to do this using just Composer and GitHub. Setting up Satis or Trojan isn't something we're keen on having to do. It seems from the documentation that we should be able to access our private repos using a personal access token.

score 4 · Accepted Answer · answered Sep 08 '15 at 13:44

Instead of HTTPS, use this syntax:

"repositories": [
    {
        "type": "vcs",
        "url": "git@github.com:vendor/package.git"
    }
]

We use this quite often, successfully.

See here: https://getcomposer.org/doc/05-repositories.md#using-private-repositories

Using a Composer with private GitHub repos over HTTPS

1 Answers1