Connecting Private Packagist to Stacktic

For: a Private Packagist organization admin. Takes about 5 minutes.

What this integration does

Private Packagist is the paid Composer package registry at packagist.com. It's built around organizations. It's a different product from the public packagist.org, which has no organizations or members at all.

Connecting it lets Stacktic read who belongs to your organization's teams. Once you turn removal on, Stacktic can also remove someone from every team they're on during an offboarding. That takes away the package permissions those teams gave them.

To connect, you create a pair of values in your organization's Settings, which Private Packagist calls an API key and secret. Both belong to your organization as a whole. Stacktic stores the pair encrypted and only uses it with your organization.

Stacktic needs two values:

Value	What it is
API key	The public half of an API credential, created under organization Settings → API access.
API secret	The private half of the same credential. It's shown once, when you create it.

Before you start

You need to be an admin on the Private Packagist organization, able to create API credentials under Settings → API access.
Your company might run more than one Private Packagist organization. Each API credential works with a single organization. So you'll set up one Stacktic connection per organization.

Step 1: Create an API credential

In Private Packagist, go to your organization's Settings → API access.
Create a new API credential.
Copy both the key (packagist_ack_…) and the secret (packagist_acs_…) right away. The secret is shown once, next to the key. If you lose it, the only fix is to create a new credential.
If you want the credential to expire, set that when you create it. Private Packagist makes this optional. But its API never reports the expiration date once the credential exists. So if you set one, you'll enter that same date in Stacktic yourself in the next step.

Step 2: Connect in Stacktic

On the tool's Integration tab (Tools → Private Packagist → Integration), enter:

API key: the key from Step 1.
API secret: the secret from Step 1.
Expiration date (if Stacktic asks): enter the date you set in Step 1. Leave it blank if the credential has none. Private Packagist doesn't report an expiration on its own. So this is the only way Stacktic knows to warn you before the credential runs out.

Click Connect. Stacktic checks the pair against your organization's team list before saving anything.

Step 3: Turn on automated user removal (when you're ready)

Stacktic starts reading your team member lists as soon as you connect. Removing someone from their teams during an offboarding is a separate switch. Because removal is destructive, it's off by default. When you're ready, turn on Automated user removal on the Integration tab.

What "connected" looks like

Once you're connected, Stacktic shows everyone who's on at least one team in your organization. Each person is labeled with the strongest permission any of their teams gives them: Owner, Admin, Edit, View, or Billing.

Private Packagist's own API only ever returns a username for a team member. It never returns an email address or a display name. So Stacktic matches a Private Packagist member to the right person by username. A GitHub organization on the Team plan and an AWS IAM user have the same limit.

What this member list doesn't cover

Private Packagist has no way to list an organization's members directly. So the list Stacktic reads is everyone who's on at least one team, combined. That list doesn't include:

Customers: outside users of your packages. Private Packagist treats them separately from team members.
Composer authentication tokens: a team token, or a person's own Composer token. Neither is tied to a team membership Stacktic can see.
Suborganizations, or anyone reaching a package through CI trusted publishing.

So someone missing from every team isn't proof they have no way to reach a package. Stacktic doesn't treat their absence here as evidence of "no access."

What removal does (and doesn't do)

Once you turn on Automated user removal, offboarding someone removes them from every team they're on in this organization. That takes away the package permissions those teams gave them.

Removal does not:

remove them from the Private Packagist organization itself. Private Packagist's API has no way to do that, so their organization membership stays.
stick, if any of those teams are synchronized from a linked GitHub or GitLab organization. The next sync can add the person right back. Stacktic has no way to tell whether a given team has sync set up.

Security notes

You can't choose a smaller permission here. Private Packagist's API credentials can't be limited to less than the whole organization. There's no read-only vs. read-write choice like GitHub's fine-grained tokens offer. Start with Automated user removal off if you're not ready for it.
The credential belongs to the organization, not a person. It's created under organization Settings and isn't tied to the admin who made it. So it keeps working if that person leaves.
Stored encrypted. Stacktic keeps only the key and secret, both encrypted. It never shows the full secret again. The connected card shows the key in full and only the secret's last four characters.
You can cut it off anytime. Delete the credential in Private Packagist (Settings → API access) and the connection stops working right away.

Troubleshooting

Message in Stacktic	Likely cause and fix
"Private Packagist rejected the API key." (HTTP 401)	The key or secret is wrong, or the credential was deleted or disabled in Private Packagist. Create a new credential and reconnect.
"Private Packagist rejected the request signature." (HTTP 400)	Usually the API secret was mistyped. The secret is used to sign every request. So a wrong secret causes a signature error, not a plain "wrong credential" message. Check that you copied the full secret.
Offboarding removal reports the person wasn't found on any team	They were already removed from every team, or were never on one. Stacktic counts this as done.
A member never matches to a person	Private Packagist reports only usernames, never email. Sort them out in the unmapped-users list by matching the username to the employee.
Someone reappears on a team after being removed	One of their teams is synchronized from a linked GitHub or GitLab organization, and a sync added them back. Check that team's sync settings in Private Packagist.

Frequently asked questions

Does this remove someone from the Private Packagist organization? No. It removes them from every team they're on, which cuts off the package permissions those teams give them. Private Packagist's API has no way to remove someone from the organization itself.

Why does Stacktic only show a username, not a name or email? That's all Private Packagist's team API returns for a member. You'll match usernames to people once. It's the same one-time step as a GitHub Team-plan connection.

Will connecting remove or change anything right away? No. Connecting only reads your team member lists. Stacktic removes people only during an offboarding, and only after you turn on Automated user removal.

What about package Customers or Composer tokens? Those aren't team members, so they won't appear here. This integration only sees team membership.