Er Amit Gupta: “I'm using Private Satis to distribute paid Composer packages…”

Er Amit Gupta @eramitgupta14hd495f87

How do you handle licensing for paid Composer packages? I want a **single license to work on only one system** — either local or production server, not both. One license = One active installation. What's the best way to enforce this without API calls from the package itself?

Jérôme Tamarelle @GromNaN14h48c1ada

Private Packagist is made for that.

For Vendors

Unique Composer repository URL and authentication token per customer
Grant customers access to individual packages
Restrict package access by version constraint or timeframe to match your licensing model
Granular per-customer version specific install statistics
You can opt out of the core features for everyone if you require exclusively the vendor features. Additional users are then free, and you only pay the base plan plus your customers.

https://packagist.com/pricing

Er Amit Gupta @eramitgupta12h

I'm using Private Satis to distribute paid Composer packages. What's the best approach to handle single-license restrictions? Ideally, one license should work on only one system — either local or production, not both. How are you handling license validation with Satis?

12:24 · Nov 13, 2026commit 052274b

Jérôme Tamarelle @GromNaN11h

Satis is a basic package metadata server with no security features at all. Definitely not the tool for your need. Your clients will hate your restrictrictive license mechanism. As much as everybody hate Oracle : they make you pay per number of CPU! Contact @Seldaek for more…

Commit