How do you install a Magento 2 extension with Composer?

To install a Magento 2 extension with Composer, add the vendor's repository to your project, store your access keys, run composer require vendor/package, then run bin/magento setup:upgrade and, in production mode, recompile and deploy static content before cleaning the cache. Adobe's own guide follows the same order: require the package, check and enable the module, run setup:upgrade, run setup:di:compile, then clean the cache¹. Do it on a staging copy first, with a database backup and maintenance mode on the live store.

What do you need before you start?

• Shell access to the server as the Magento file system owner. Adobe's documentation states that "All Magento CLI commands must be run by the file system owner"³, so do not run bin/magento or composer as root. On a typical server you switch to the web server user (for example sudo -u www-data bash) or log in as the dedicated owner account.
• Composer 2 and a PHP version that your Magento release supports. Adobe publishes the supported PHP and Composer combinations for each 2.4.x release and only supports those combinations¹⁰.
• The package name (vendor/module-name) and, for paid extensions, access keys from the vendor.
• A staging environment that matches production, and a recent database backup.

Why use Composer instead of a zip file in app/code?

You can still copy a module into app/code/Vendor/Module and run setup:upgrade, but Composer is the better choice for anything you plan to keep.

Composer's documentation recommends committing composer.lock to version control so that everyone working on the project gets the same package versions⁵. That is what makes staging and production behave the same.

How do you add a private Composer repository and auth.json?

Paid extensions usually live in a vendor's private repository rather than on Packagist. Run these commands in the Magento root (the folder with composer.json):

composer config repositories.vendorname composer https://repo.example.com
composer config --auth http-basic.repo.example.com PUBLIC_KEY PRIVATE_KEY

The first command adds the repository to composer.json. The second writes your credentials to a project auth.json next to composer.json. Composer can also read credentials from a global auth.json in your Composer home directory (add --global to the config command), or from the COMPOSER_AUTH environment variable². The resulting file looks like this:

{
    "http-basic": {
        "repo.example.com": {
            "username": "PUBLIC_KEY",
            "password": "PRIVATE_KEY"
        }
    }
}

Keep auth.json out of git. Composer's documentation says to make sure auth.json is in .gitignore so credentials do not leak into your history, and advises against putting credentials in composer.json itself².

Composer warns that values passed on the command line can end up in files such as ~/.bash_history², so in CI set COMPOSER_AUTH from the pipeline's secret store rather than typing it into a shell.

Which commands install and enable the extension?

Enable maintenance mode on the live store. You can exempt your own IP address so you can test while customers see the 503 page⁴:

bin/magento maintenance:enable --ip=192.0.2.10

Then install and register the module:

composer require vendor/module-name
bin/magento module:status Vendor_Module
bin/magento module:enable Vendor_Module --clear-static-content   # only if it shows as disabled
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento setup:static-content:deploy   # production mode, add your locales
bin/magento cache:clean
bin/magento maintenance:disable

Adobe notes that a newly added extension is usually disabled, which is why you check module:status first¹. In production mode static files are not generated on demand, so setup:static-content:deploy is required; in default and developer modes Magento generates them as needed³. If you see storefront errors after cache:clean, Adobe suggests cache:flush¹. Then configure the extension in the Admin.

How do you update an extension?

Run the update on staging first, then repeat it on production from the updated composer.json and composer.lock:

composer update vendor/module-name
bin/magento setup:upgrade --keep-generated
bin/magento setup:static-content:deploy
bin/magento cache:clean

These are the commands in Adobe's upgrade guide¹. To move to a specific version, use composer require vendor/module-name:^2.1 instead. Naming the package limits the update to that package; add -w if its dependencies also need to move⁶. In production mode, also run setup:di:compile as you did for the installation. On production, deploy the committed lock file with composer install, which installs exactly the locked versions⁵.

How do you remove a module cleanly?

You have two routes, and they do different things.

• bin/magento module:uninstall Vendor_Module works only with modules installed as Composer packages. It runs composer remove for you, puts the store into maintenance mode while it works, and removes database data and schema only if you add --remove-data. Adding --backup-db writes a database backup to var/backups first⁷.
• composer remove vendor/module-name removes the package from composer.json and uninstalls it⁶. It is the same code removal step module:uninstall performs, without the dependency check, backups or the optional --remove-data clean-up, so the module's database data stays behind⁷.

For a module in app/code, module:uninstall does not remove the code from the file system; you delete the folder yourself or simply disable the module⁷. Adobe recommends performing uninstallation on a non-production environment first and testing thoroughly⁷. If you might use the module again, disabling it is the gentler option.

What are the common Composer errors and how do you fix them?

Authentication required, 401 or 403. The keys are missing, wrong, revoked, or stored under the wrong host name. The host in http-basic.<host> must match the repository host exactly². A 403 means the repository refused access to that package or version; check your licence or entitlement with the vendor.

Could not find package / no matching version. Check the package name for typos and confirm the repository is defined in your root composer.json, because repositories are not inherited from dependencies⁸. If only a beta or development version exists, the default minimum-stability of stable will ignore it⁹. Prefer asking the vendor for a stable release over lowering stability for the whole project.

PHP version conflicts. Packages declare the PHP version they need in require, as a platform requirement⁹. Run composer why-not vendor/module-name 2.1.0 to see what is blocking it, including platform requirements such as PHP⁶⁸, then pick a compatible version or upgrade PHP within Adobe's supported range¹⁰.

Magento version conflicts. Extensions also require specific versions of Magento packages. The same why-not command shows which installed package blocks the install. Choose an extension release built for your Magento version.

Memory limit. Composer already raises PHP's memory limit to 1.5G internally. If it still runs out, use COMPOSER_MEMORY_LIMIT=-1 composer require vendor/module-name, and make sure you are on Composer 2: Composer's documentation notes that Composer 1 used much more memory⁸.

Installing our modules

Our Magento 2 extensions are served from our private repository at repo.softawarecommerce.com. After purchase, sign in and open My account → Composer keys to create a key pair: the public key is the username and the private key is the password, and the private key is shown only once. You can create separate keys per project, developer or CI pipeline and revoke any of them independently. The exact commands, update rules and troubleshooting notes are on our Composer access page¹¹. Browse the extension catalogue for package names.

Frequently asked questions

Do I need to run module:enable after composer require?

Check bin/magento module:status Vendor_Module first. Adobe notes that a new extension is usually disabled, and enables it with module:enable before setup:upgrade¹.

Can I commit auth.json if the repository is private?

No. Composer's documentation recommends adding auth.json to .gitignore². Use per-developer keys locally and COMPOSER_AUTH from a secret store in CI.

Should I run setup:static-content:deploy in developer mode?

It is not needed: in default and developer modes Magento generates static files on demand. It is required in production mode³.

Is composer remove enough to uninstall a module?

It removes the code, but not the module's database data. Use bin/magento module:uninstall --remove-data if you want the module's own uninstall routine to clean up its data⁷.

Can I install a module from a zip file instead?

Yes, by extracting it to app/code/Vendor/Module and running bin/magento setup:upgrade. You lose locked versions and Composer updates, so use it only when Composer is not an option.

What to do next

Install on staging, test the storefront and Admin, then repeat the same commands on production from your committed composer.lock. Browse our Magento 2 extensions for ready-made modules, or see our Magento development services if you need a custom module built for your store.

Sources

1. Adobe Commerce Operations documentation, "Manage extensions" (install, upgrade and uninstall third-party extensions), https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/tutorials/extensions, checked 8 October 2026. ↩1 ↩2 ↩3 ↩4 ↩5
2. Composer documentation, "Authentication for privately hosted packages and repositories", https://getcomposer.org/doc/articles/authentication-for-private-packages.md, checked 8 October 2026. ↩1 ↩2 ↩3 ↩4 ↩5
3. Adobe Commerce Operations documentation, "Deploy static view files", https://experienceleague.adobe.com/en/docs/commerce-operations/configuration-guide/cli/static-view/static-view-file-deployment, checked 8 October 2026. ↩1 ↩2 ↩3
4. Adobe Commerce Operations documentation, "Enable or disable maintenance mode", https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/tutorials/maintenance-mode, checked 8 October 2026. ↩
5. Composer documentation, "Basic usage", https://getcomposer.org/doc/01-basic-usage.md, checked 8 October 2026. ↩1 ↩2 ↩3
6. Composer documentation, "Command-line interface / Commands", https://getcomposer.org/doc/03-cli.md, checked 8 October 2026. ↩1 ↩2 ↩3
7. Adobe Commerce Operations documentation, "Uninstall modules", https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/tutorials/uninstall-modules, checked 8 October 2026. ↩1 ↩2 ↩3 ↩4 ↩5 ↩6
8. Composer documentation, "Troubleshooting", https://getcomposer.org/doc/articles/troubleshooting.md, checked 8 October 2026. ↩1 ↩2 ↩3
9. Composer documentation, "The composer.json schema", https://getcomposer.org/doc/04-schema.md, checked 8 October 2026. ↩1 ↩2
10. Adobe Commerce Operations documentation, "System requirements", https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/system-requirements, checked 8 October 2026. ↩1 ↩2
11. SoftAware Commerce, "Composer access", https://softawarecommerce.com/shop/composer-access/, checked 8 October 2026. ↩