Install with Composer

Every licensed UnleashWP plugin and theme is also available as a Composer package. If your sites are built and deployed with Composer, you can pull our products in the same way as everything else, with your license key as the only credential.

What Composer is

Composer is the package manager for PHP. You list the plugins and themes a site needs in a file called composer.json, run one command, and Composer downloads exactly those versions into the right folders. It also writes a composer.lock file that pins every version, so your laptop, your staging server and your live server all end up with the same code.

Before you start

• Composer 2 installed on your computer or build server (composer --version).
• A WordPress project that already has a composer.json, for example a Bedrock project or your own setup.
• An active UnleashWP license. You find it in your account under Licenses.

Quick start

Step by step

1. Tell Composer your license key

Your license key is the password. The user name is not checked, the account uses unleashwp. Pick one of these ways:

composer config --global --auth http-basic.composer.unleash-wp.com unleashwp YOUR_LICENSE_KEY

{
  "http-basic": {
    "composer.unleash-wp.com": {
      "username": "unleashwp",
      "password": "YOUR_LICENSE_KEY"
    }
  }
}

echo "auth.json" >> .gitignore

2. Add the repository and the package

Add our repository and require the package in your project's composer.json:

{
  "repositories": [
    { "type": "composer", "url": "https://composer.unleash-wp.com" }
  ],
  "require": {
    "unleashwp/easy-svg-pro": "^1.0"
  },
  "config": {
    "allow-plugins": {
      "composer/installers": true
    }
  }
}

• Every package is named unleashwp/ followed by the product's slug, for example unleashwp/easy-svg-pro. The dialog in your account shows the exact name and a version constraint for the current release.
• Our packages depend on composer/installers, which moves plugins and themes into the WordPress folders. Composer 2.2 and newer asks before it runs such a plugin. The allow-plugins entry answers that question in advance, which matters on a build server where nobody can type "yes".

Then install:

composer update unleashwp/easy-svg-pro

3. Where the files go

composer/installers reads the package type:

If your WordPress lives somewhere else, set installer-paths. In a Bedrock project this is already done:

{
  "extra": {
    "installer-paths": {
      "web/app/plugins/{$name}/": ["type:wordpress-plugin"],
      "web/app/themes/{$name}/": ["type:wordpress-theme"]
    }
  }
}

4. Activate the license from wp-config.php

Composer only brings the files. The license is activated by a constant in wp-config.php. Read the key from the server environment, so it is not in Git either:

define( 'EASY_SVG_PRO_LICENSE_KEY', getenv( 'EASY_SVG_PRO_LICENSE_KEY' ) );

Then set EASY_SVG_PRO_LICENSE_KEY on the server, in your hosting panel, your .env file or your deployment tool. The next time an administrator opens wp-admin, the site activates itself and uses one seat of your license. More on this in Activate a license key and Deploy with Git and CI.

Updating

composer update unleashwp/easy-svg-pro

This fetches the newest version your constraint allows and writes it into composer.lock. Commit composer.lock. Every later composer install, on any machine, then installs exactly the version in that file, which keeps staging and live identical.

With an active license, WordPress also offers updates under Dashboard → Updates. On a Composer site you usually want Composer to be the only source, so that the files on the server always match composer.lock. Turn off updates from wp-admin with:

define( 'DISALLOW_FILE_MODS', true );

Use it in CI

On a build server, give Composer the key through the COMPOSER_AUTH environment variable instead of a file. Store the key as a secret in your CI system, never in the repository.

- name: Install PHP dependencies
  env:
    COMPOSER_AUTH: '{"http-basic":{"composer.unleash-wp.com":{"username":"unleashwp","password":"${{ secrets.UNLEASHWP_LICENSE_KEY }}"}}}'
  run: composer install --no-dev --no-interaction --prefer-dist

export COMPOSER_AUTH='{"http-basic":{"composer.unleash-wp.com":{"username":"unleashwp","password":"YOUR_LICENSE_KEY"}}}'
composer install --no-dev --no-interaction --prefer-dist

One license per project

Composer can store only one password per host. Since your license key is that password, one project uses one license key for everything it installs from composer.unleash-wp.com.

• The key lists only the products that license includes. Two products bought as separate licenses cannot both be installed through Composer in the same project with one key.
• Installing with Composer does not use a seat. A seat is used when a site activates itself from the wp-config.php constant, see Licenses.
• For agencies: use the license you bought for that client's project, so each project only ever holds its own key.

Troubleshooting

Security notes

• Your key travels only in the request header to composer.unleash-wp.com, never in a URL.
• Keep auth.json out of Git. Prefer the global command on your computer and COMPOSER_AUTH on build servers.
• Do not put the key into composer.json, composer.lock, Dockerfiles or build logs.
• If a key was exposed, contact support right away.