🔑 Authentication

Manage Composer's auth.json credentials file, configuring GitHub / GitLab / Bitbucket / Bearer / HTTP Basic authentication tokens for private repositories and protected APIs.

Composer Skills wraps auth.json read/write operations into a set of type-safe methods. All Add methods follow the atomic "read → modify → write back" pattern: first call GetAuthConfig to get the current configuration (returns empty config if file doesn't exist), modify entries in memory, then call SaveAuthConfig to write back to ~/.composer/auth.json with 0600 permissions.

When to Use

• 🗝️ Project depends on private Git repositories (self-hosted GitLab, Bitbucket team spaces); composer install requires tokens to pull.
• 🤖 CI scripts dynamically inject deployment credentials without hardcoding tokens in auth.json.
• 🔄 Token rotation: remove old token, write new token.
• 🔍 Audit: list currently configured authentication entries to confirm no stale credentials remain.

Structured Types

AuthConfig

Top-level structure operated on by GetAuthConfig / SaveAuthConfig, corresponds to the root object of auth.json.

type AuthConfig struct {
	GitHub       map[string]string `json:"github-oauth,omitempty"`
	GitLab       map[string]string `json:"gitlab-oauth,omitempty"`
	GitLabToken  map[string]string `json:"gitlab-token,omitempty"`
	Bitbucket    map[string]string `json:"bitbucket-oauth,omitempty"`
	Bearer       map[string]string `json:"bearer,omitempty"`
	HTTPBasic    map[string]string `json:"http-basic,omitempty"`
	AWSAccessKey map[string]string `json:"aws-access-key,omitempty"`
}

Each field is a "domain → credentials" mapping. Values for Bitbucket and HTTPBasic are stored in consumer:token / username:password format.

authType String Constants

The authType parameter of RemoveToken / GetToken must be one of: github-oauth, gitlab-oauth, bitbucket-oauth, bearer, http-basic. Passing other values returns ErrInvalidAuthType.

Method Signatures

Method	Signature	Description
🔑 GetAuthConfig	func (c *Composer) GetAuthConfig() (*AuthConfig, error)	Read auth.json; returns empty config if file doesn't exist
💾 SaveAuthConfig	func (c *Composer) SaveAuthConfig(config *AuthConfig) error	Write back to auth.json with 0600 permissions
🐙 AddGitHubToken	func (c *Composer) AddGitHubToken(domain string, token string) error	Add GitHub OAuth token
🦊 AddGitLabToken	func (c *Composer) AddGitLabToken(domain string, token string) error	Add GitLab OAuth token
🪣 AddBitbucketToken	func (c *Composer) AddBitbucketToken(domain string, consumer string, token string) error	Add Bitbucket OAuth token (consumer:token)
🎟️ AddBearerToken	func (c *Composer) AddBearerToken(domain string, token string) error	Add Bearer token
🔐 AddHTTPBasicAuth	func (c *Composer) AddHTTPBasicAuth(domain string, username string, password string) error	Add HTTP Basic auth (username:password)
🗑️ RemoveToken	func (c *Composer) RemoveToken(authType string, domain string) error	Remove token by type and domain
🔍 GetToken	func (c *Composer) GetToken(authType string, domain string) (string, error)	Read token by type and domain

Parameters

AddBitbucketToken

Parameter	Type	Description
domain	string	Repository domain, e.g., bitbucket.org or self-hosted instance domain
consumer	string	OAuth consumer key
token	string	OAuth access token

RemoveToken / GetToken

Parameter	Type	Description
authType	string	Authentication type, see the constant list above
domain	string	Domain the token corresponds to

Examples

Inject GitHub Token

package main

import (
	"fmt"
	"log"

	"github.com/scagogogo/composer-skills/pkg/composer"
)

func main() {
	comp, err := composer.New(composer.DefaultOptions())
	if err != nil {
		log.Fatalf("Failed to initialize Composer: %v", err)
	}

	// Write OAuth token for github.com
	if err := comp.AddGitHubToken("github.com", "ghp_xxxxxxxxxxxxxxxxxxxxxxxx"); err != nil {
		log.Fatalf("Failed to write GitHub token: %v", err)
	}

	// Read back to verify
	token, err := comp.GetToken("github-oauth", "github.com")
	if err != nil {
		log.Fatalf("Failed to read token: %v", err)
	}
	fmt.Printf("github.com token prefix: %s...\n", token[:10])
}

Configure Multiple Credentials for Self-hosted GitLab

// Self-hosted GitLab instance
if err := comp.AddGitLabToken("gitlab.example.com", "glpat-xxxxxxxxxxxxxxxxxxxx"); err != nil {
	log.Fatal(err)
}

// Private Composer repository using HTTP Basic
if err := comp.AddHTTPBasicAuth("packages.example.com", "ci-deploy", "s3cret-pass"); err != nil {
	log.Fatal(err)
}

// Another repository using Bearer
if err := comp.AddBearerToken("api.example.com", "Bearer-token-value"); err != nil {
	log.Fatal(err)
}

Rotate Token: Remove Old, Write New

// Remove old GitHub token
if err := comp.RemoveToken("github-oauth", "github.com"); err != nil {
	if err == composer.ErrInvalidAuthType {
		log.Fatal("Unsupported authentication type passed")
	}
	log.Fatal(err)
}

// Write new token
if err := comp.AddGitHubToken("github.com", "ghp_newrotatedtoken"); err != nil {
	log.Fatal(err)
}

Full Read and Iterate

config, err := comp.GetAuthConfig()
if err != nil {
	log.Fatal(err)
}
for domain, token := range config.GitHub {
	fmt.Printf("github-oauth  %s  %s***\n", domain, token[:6])
}
for domain := range config.HTTPBasic {
	fmt.Printf("http-basic   %s\n", domain)
}

Advanced

0600 Permissions

SaveAuthConfig writes auth.json with 0600 (owner read/write only) to prevent token leakage to other users on the same machine. Do not manually chmod to loosen permissions.

No Convenience Method for AWS Tokens

AuthConfig includes the AWSAccessKey field for compatibility, but currently no AddAWSAccessKey convenience method is provided. To write, manually construct *AuthConfig and call SaveAuthConfig.

Relationship with GetComposerHome

All methods resolve the auth.json path via c.GetComposerHome(). If the COMPOSER_HOME environment variable is set, the file goes in that directory; otherwise, Composer's default home directory is used.