Private Composer and npm registry for Magento and PHP agencies

One token per developer. Client keys stay in the broker, not on laptops.

Marketplace and vendor keys are stored per client project; developers and CI get broker tokens. Every archive installed through the broker is stored by the broker, so deploys keep working when a vendor repository is down.

Offboarding through your identity provider: remove someone from the group and access ends within 24 hours; no vendor keys on laptops to rotate.
A freelancer on one client: grant one project; every other project returns 404. They sign in through your identity provider.
Installs that survive vendor repository outages for every version already installed through the broker.

Start the quickstart Watch releases

2.0 is in development; no tagged release yet. Marketplace sources: built, in final verification. Compare with Private Packagist

auth.jsonWith Package Broker

1{2"http-basic": {3"<broker-host>": {4"username": "token",5"password": "pb_pat_…"6}7}8}

One entry covers every client project your token can access.

What changes for your team

Deploys that don’t wait for a vendor repository

Every archive installed through the broker is stored by the broker and served from that copy before any request to the vendor repository.

deploy › composer installIllustrationvendor-a repository: unavailable

$ composer install --no-dev --optimize-autoloader
Installing dependencies from lock file
Verifying lock file contents can be installed on current platform.
  - Downloading vendor-a/module-x (<version>)
  - Downloading vendor-b/module-y (<version>)
  …
  - Installing vendor-a/module-x (<version>): Extracting archive
  - Installing vendor-b/module-y (<version>): Extracting archive
  …
Generating optimized autoload files

Archives served by <broker-host> from storage

Installed through the broker before: served from the stored archive while the vendor repository is down or slow, or a key stops working.
First install of a new version: still needs the vendor repository once. After that, the broker keeps the archive.

When someone leaves

Access granted through an identity provider group follows that group. After a one-time rotation when you move existing keys into the broker, nobody holds vendor keys to rotate.

With Package BrokerNo vendor keys to rotate

0 hRemoved from the group in your identity providerEnds their group access.
up to 12 hBrowser session endsSessions last 12 h at most and end after 1 h idle.
within 24 hPersonal token stops workingpb_pat_ tokens lose group access once the last sign-in is over 24 h old. Developers keep a personal token active by signing in to the broker at least once a day; CI service tokens are not affected.

CI service tokens (pb_svc_) are not tied to a person. Revoke them in the broker; it applies on the next request.

E-mail grants: remove the grant or suspend the user in the broker; applies on their next request.

TodayRotate every key the person had, at every client and vendor, then update auth.json and CI variables.

client-a Marketplace
vendor-a
CI variables
9 more keys

How it works

One deployment is one organization. Give each client a project and select its sources with that client’s credentials. Sign-in uses Cloudflare Access or an OpenID Connect provider such as Dex, and its groups grant project access. Composer and npm authenticate with a token; CI gets a read-only service token bound to one project.

Arrows follow package requests from package managers through tokens and projects to sources. Identity provider groups grant project access. Prefixes identify personal (pb_pat_) and service (pb_svc_) tokens.

No seat counting

The software does not count or cap users. Add juniors, freelancers, QA and CI pipelines without a new licence line. No licence fee: you pay for your own hosting, from USD 5 a month on Cloudflare Workers Paid plus usage, or your own Node host.

What you run

You operate the broker. These are the requirements and responsibilities for each runtime.

Workers and Docker deployment requirements and operator responsibilities
Item	Cloudflare Workers	Docker / Node
Prerequisites	Workers Paid plan, Node 24 and pnpm.	Docker, Node 24 and pnpm to build; a host with persistent storage. Container image publishing (GHCR) is planned; build the image from the repository.
Resources you run	Workers, D1, R2, Queues and Cron Triggers.	The Node bundle, SQLite and a filesystem blob store, or an S3-compatible bucket.
You own	Backups, master key recovery, upgrades and the identity provider. Organization admins and the master key holder can use every client’s keys; rotate them when an admin leaves.	Backups, master key recovery, upgrades, the host and the identity provider. Organization admins and the master key holder can use every client’s keys; rotate them when an admin leaves.
Cost floor	From USD 5 per month (Workers Paid account minimum) plus usage beyond the included requests and CPU time; D1, R2 and Queues are billed by usage. Workers pricing (checked 2026-10-25).	Your host, storage and operations.
Support	Community issues and Discussions; one maintainer during pre-release. Governance.	Community issues and Discussions; one maintainer during pre-release. Governance.
Licence	AGPL-3.0-only.	AGPL-3.0-only.

Status and maintainer

2.0 is in development; no tagged release yet. Marketplace sources: built, in final verification. Maintained by lbajsarowicz, AGPL-3.0-only. If the project stops, your deployment keeps running: the code is AGPL and your data stays in your own D1 and R2, or SQLite and your blob store.

To evaluate alone you do not need an identity provider: setup creates a local administrator protected by a password and an authenticator app.

Removing someone from a group ends their access after the revalidation window; service tokens they created for CI stay valid until you revoke them. Session and membership revalidation.

Package Broker 1.x is no longer maintained (package-broker/server). Watch the repository for the first 2.0 release.

Quickstart

Choose a runtime. Install Node 24 and pnpm, then clone the broker repository with the commands below.

2.0 is in development; no tagged release yet. Build from source.

Needs the Workers Paid plan, with CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN set in your environment. Use paths outside the checkout for the master key and setup token files; setup creates them for a new deployment.

Shell, Cloudflare Workers

git clone https://github.com/package-broker/broker.git
cd broker
pnpm install --frozen-lockfile
pnpm build
pnpm pb cloudflare setup \
  --worker-name <worker-name> \
  --org-slug <organization-slug> \
  --org-name "<organization-name>" \
  --admin-email <email> \
  --key-file <master-key-file> \
  --token-file <setup-token-file>

Open /_pb/ui/setup on your broker to finish administrator setup. Workers quickstart

Container image publishing (GHCR) is planned; build the image from the repository. Generate a master key with pnpm pb secrets generate-master-key and store it for recovery before starting.

Shell, Docker build and run

git clone https://github.com/package-broker/broker.git
cd broker
docker build -t package-broker .
pnpm install --frozen-lockfile
pnpm build
pnpm pb secrets generate-master-key
export PB_MASTER_KEY='<generated-master-key>'
docker run -d --name package-broker \
  -p 8787:8787 -v pb-data:/data \
  -e PB_MASTER_KEY \
  -e PB_ORG_SLUG='<organization-slug>' \
  -e PB_ORG_NAME='<organization-name>' \
  -e PB_PUBLIC_URL='http://localhost:8787' \
  package-broker
until [ "$(docker inspect --format '{{.State.Health.Status}}' package-broker)" = healthy ]; do
  sleep 1
done
docker exec -it package-broker node /app/cli/dist/bin.js admin bootstrap \
  --email '<email>' --sqlite /data/broker.sqlite

Wait for the broker to be ready, then bootstrap the first administrator inside the container. Open /_pb/ui/setup and paste the setup token from the terminal. Copy it now. You cannot see it again. Docker quickstart Dockerfile · Administrator CLI reference

Workers quickstart View the repository on GitHub