Install premium WordPress plugins with Composer

Premium plugins usually arrive as zip files: you download them from the vendor's account page and upload them by hand, on every site, for every update. MeteorGPL serves them as Composer packages instead, so they are versioned, locked and installed like the rest of your dependencies. This guide takes a project from nothing to its first composer require.

Step 1 — Create a Composer token#

Composer signs in to the repository with a token. Sign in to MeteorGPL, open Settings → Composer tokens and create one. Copy it straight away: it is shown once.

A token can be limited when you create it: to certain packages, to IP ranges, or until a date. For your own machine an unrestricted personal token is fine; for servers and pipelines, read Composer tokens in CI.

Step 2 — Store the token for Composer#

composer config --global http-basic.composer.meteorgpl.ddev.site token <your-token>

The user name is the literal word token; the password is the token itself. Composer keeps the pair in its global auth.json (~/.composer/auth.json, or $COMPOSER_HOME/auth.json), never in the project, so it cannot be committed by accident.

Step 3 — Add the repository to the project#

In the folder that holds your project's composer.json:

composer config repositories.meteorgpl composer https://composer.meteorgpl.ddev.site

Step 4 — Tell Composer where WordPress packages go#

Plugins are published with the type wordpress-plugin, themes with wordpress-theme. The composer/installers package reads those types and puts each package where WordPress looks for it. For a classic WordPress install, composer.json looks like this:

{
    "repositories": [
        { "type": "composer", "url": "https://composer.meteorgpl.ddev.site" }
    ],
    "require": {
        "composer/installers": "^2.0"
    },
    "extra": {
        "installer-paths": {
            "wp-content/plugins/{$name}/": ["type:wordpress-plugin"],
            "wp-content/themes/{$name}/": ["type:wordpress-theme"]
        }
    },
    "config": {
        "allow-plugins": { "composer/installers": true }
    }
}

composer/installers is itself a Composer plugin, and Composer asks before it runs one; allow-plugins answers that question in advance.

Step 5 — Find the package name#

Every package page shows its install command. The names follow one rule:

The slug is the plugin's or theme's own folder name, lower-cased, so the package lands in the directory the vendor ships and WordPress sees no difference.

Step 6 — Require the plugin#

composer require meteorgpl-plugin/elementor-pro:^3.21

Composer downloads the version, places it in wp-content/plugins/elementor-pro/ and records the exact version and the checksum of its zip in composer.lock. Commit composer.json and composer.lock: every other environment then installs the same bytes with composer install.

The caret constraint (^3.21) lets composer update bring in new minor and patch versions, never the next major one. Every published version stays available, so going back is one command:

composer require meteorgpl-plugin/elementor-pro:3.20.0

Step 7 — Activate it with your license key#

Nothing in a package is modified: the vendor's license, activation and update code is shipped as it is. Activate the plugin in WordPress with the license key you bought from the vendor; support and the vendor's own update channel come with that key.

Keep your keys in the license key vault (Settings → License keys): they are stored encrypted, shown on each package's page, and you are reminded 30 and 7 days before one expires.

If something goes wrong#

• 401 Unauthorized — Composer sent no token, or an unknown, expired or revoked one. Repeat step 2 with a new token.
• 403 Forbidden — the token is valid, but the account has no repository access. Check Settings → Billing and plans, or ask the owner of your organisation.
• The plugin landed in vendor/ — composer/installers is missing, or Composer was not allowed to run it. Check require and allow-plugins from step 4.

Next steps#

• Working with Bedrock? Read Use MeteorGPL in a Bedrock project.
• Installing from a pipeline? Read Composer tokens in CI.
• Want to hear about new versions and security fixes? Read Keep plugins up to date and watch for vulnerabilities.
• The documentation covers naming, versions and the JSON API in one page.