Managing WordPress Dependencies with Composer – Octolize Plugins

TL;DR

Composer turns manual plugin drops into wp-content/ into a versioned, reproducible setup. Start the project with Bedrock, pull free plugins like WooCommerce and Flexible Shipping via WPackagist, and fetch PRO plugins from the private composer.octolize.dev repo using a bearer token generated from your Master API key. From then on, updating the whole stack is one command.

1 – What is Composer?

Composer is the standard dependency manager for PHP. Instead of copying plugin folders into wp-content/, you list everything your site relies on in a singlecomposer.json. One command (composer install or composer update) then pulls the exact versions, places them in predictable locations, and records them in a lock-file so that every environment (local, CI, production) stays in sync.

On the other hand, you can learn about traditional way of installing a WordPress plugin in How to Install a WordPress Plugin – Guidelines for Beginners.

2 – Using Composer with WordPress

Starter kits at a glance

• Roots / Bedrock – reorganizes WordPress into a modern project structure.
• johnpbloch/wordpress-core – pulls only core without changing folders (good when you need vanilla paths).
• fancyguy/webroot-installer – keeps core outside the web root with minimal changes.

Bedrock is by far the most comprehensive, so the walkthrough below uses it.

Step-by-step with Bedrock

1. Create the projectcomposer create-project roots/bedrock my-site
2. Configure environment variables – copy .env.example to .env, then fill in DB_…, WP_HOME, WP_SITEURL, and salts.
3. Point the web-server document root to Bedrock’s web/ directory.
4. Visit https://example.test/wp/wp-admin and run the normal WordPress installer.

3 – Adding free plugins (WooCommerce & Flexible Shipping)

The easiest way to pull anything that lives on WordPress.org is WPackagist – a Composer mirror of the plugin directory.

1. Declare the repository

   {
     "repositories": [
       { "type": "composer", "url": "https://wpackagist.org" }
     ]
   }

2. Require your plugins

   composer require \
     wpackagist-plugin/woocommerce:^9.0 \
     wpackagist-plugin/flexible-shipping:^5.0

    

   woocommerce gives you the full shop suite, while flexible-shipping (by Octolize) adds powerful table-rate rules – all free on WordPress.org.
    

4 – Installing Octolize PRO plugins with Composer

Premium Octolize extensions – e.g. Flexible Shipping PRO – are distributed from a private Composer repository at
https://composer.octolize.dev. Access is secured by a bearer-token (your personal API key).

4.1 Getting your Octolize API key

1. Log in to your Octolize account: https://octolize.com/my-account/.
2. On the sidebar, click API Keys.
3. If you have an active subscription for the plugin you need, an API key is automatically created. Simply copy the Master API key displayed next to the subscription.
4. Copy your Master API key to your clipboard — this is the bearer value you will paste in the Composer auth step below.

4.2 One-time setup in Composer

# Tell Composer where the private repo lives
auth_host="composer.octolize.dev"
composer config repositories.octolize/plugins composer "https://${auth_host}"

# Store your key in global auth.json (do this on every machine/CI runner)
composer config --global --auth "bearer.${auth_host}" YOUR_MASTER_API_KEY_HERE

4.3 Require the PRO package

composer require octolize-plugin/flexible-shipping-pro

All Octolize premium packages share the octolize-plugin/* namespace, so future updates are as simple as:

composer update octolize-plugin/*

5 – Wrap-up

• Composer centralises every dependency — WordPress core, themes, free and paid plugins — into reproducible code.
• Bedrock gives WordPress a modern, Laravel-style directory layout and ships with sensible defaults.
• WPackagist mirrors the entire wordpress.org ecosystem, letting you version-pin plugins like WooCommerce or Flexible Shipping Free.
• Octolize’s private repo lets you fetch PRO extensions (e.g. Flexible Shipping PRO) the same way, secured by your personal Master API key.

Whether you run a tiny blog or a multi-store WooCommerce installation, adopting Composer today means safer updates, cleaner repos, and deployments that “just work.” Happy coding!

FAQ

Can I use Composer on an existing WordPress site, or do I have to start over?

You can add Composer to a running site, but you can’t retrofit Bedrock’s structure without a migration. The pragmatic path is johnpbloch/wordpress-core or fancyguy/webroot-installer, which keep vanilla paths or manage only plugins and themes with Composer at first and leave core alone.

Do I need a separate API key for every site or every plugin?

No. Your Master API key covers the subscriptions on your account, so one key works across all octolize-plugin/* packages you have access to. Treat it like a password: store it in a machine-local auth.json or an environment variable, never in your repository.

Will plugins installed via Composer still update from the WordPress admin?

They shouldn’t. Once a plugin is a Composer dependency, updating it through wp-admin overwrites the version your lock-file expects and gets reverted on the next deploy. Disable admin updates and run composer update instead so your repository stays the single source of truth.

How do I set this up in CI/CD?

Add the Octolize repository to composer.json (it’s committed) and inject the bearer token as a secret environment variable on the runner: COMPOSER_AUTH='{"bearer":{"composer.octolize.dev":"YOUR_KEY"}}'. That avoids writing a global auth.json on ephemeral build machines.

What’s the difference between Flexible Shipping (free) and Flexible Shipping PRO here?

Only where they come from. The free version is on WordPress.org, so it installs via WPackagist as wpackagist-plugin/flexible-shipping. PRO comes from Octolize’s private repository as octolize-plugin/flexible-shipping-pro and requires an active subscription plus your API key.