Magento Composer auth failure for repo.magento.com keys in CI

By Kaveh Alemi·Latchkey

Magento packages come from repo.magento.com, which requires a Marketplace public/private key pair. In CI those keys live in secrets, not the repo, so without them Composer is prompted for credentials it cannot supply and fails non-interactively.

What this error means

composer install fails with "Could not authenticate against repo.magento.com" or a 401, and "Authentication required (repo.magento.com)" while resolving magento/product-community-edition.

In Authentication required (repo.magento.com):
  Username: Your Magento Marketplace public key
  Password: Your Magento Marketplace private key
  The "https://repo.magento.com/packages.json" file could not be downloaded (HTTP/2 401)

Common causes

auth.json has no repo.magento.com keys

auth.json is gitignored, so the runner has no public/private key pair, and Composer cannot authenticate to the Magento repository.

The keys are present but lack access

A 401 that persists means the key pair is invalid or not entitled to the requested Magento packages.

How to fix it

Configure the keys from CI secrets

1. Store the Marketplace public and private keys as CI secrets.
2. Write them with composer config before install.
3. Run composer install non-interactively.

composer config --global http-basic.repo.magento.com \
  "$MAGENTO_PUBLIC_KEY" "$MAGENTO_PRIVATE_KEY"
composer install --no-interaction

Verify the key pair entitlement for a persistent 401

A repeating 401 will not clear by retrying; confirm the keys are valid and entitled to the packages in your account.

How to prevent it

• Keep Magento keys in CI secrets, never in committed auth.json.
• Set http-basic credentials before composer install.
• Rotate Marketplace keys and update the secret in one place.

Frequently asked questions

Related guides

References

• Composer documentation
• GitHub Actions documentation