Compare

Package Broker and Private Packagist, compared

Choose who operates your agency’s registry, how client access works and whether you need npm alongside Composer. Read when each product fits, then check the sources and recorded review dates.

Package Broker 2.0 is in development; no tagged release yet.

When Package Broker fits better

Choose Package Broker if you want to operate one Composer and npm registry for your agency. Give each developer one personal token for the projects they can access; keep each client’s vendor keys in that client’s project, encrypted in the broker.

Give a freelancer a grant to one project, without an organization role. CI gets a read-only service token bound to that project. Versions already installed through the broker stay available during vendor repository outages because their archives are stored by the broker.

No seat counting: the software does not count or cap users. You pay for hosting and operations on Cloudflare Workers or Node. Package Broker is pre-release with one maintainer; you run backups and upgrades. Marketplace sources are built, in final verification.

Agency setup and access boundaries · Security model and operator responsibilities

Package Broker, Private Packagist by criterion. Oldest source review: 2026-10-16. “Unknown” means the recorded source has not confirmed this detail; it does not mean the feature is absent. “Not documented” means the reviewed documentation does not state support.
Criterion	Package Broker	Private Packagist
Per-project isolation	Separate projects and source credentials.Package Broker: per-project isolation source · Checked 2026-10-26	Suborganizations.Private Packagist: per-project isolation source · Checked 2026-10-17
SSO	OIDC groups mapped to project grants.Package Broker: sso source · Checked 2026-10-26	Sign in through GitHub, GitLab or Bitbucket OAuth. Entra ID, Okta, LDAP, SAML and OIDC work through those platforms; plan tier is not stated.Private Packagist: sso source · Checked 2026-10-26
Authentication	Personal and service tokens for Composer and npm.Package Broker: authentication source · Checked 2026-10-26	Unknown: not confirmed by the recorded source.Private Packagist: authentication source · Reviewed 2026-10-16
npm registry	Composer and npm use one token policy.Package Broker: npm registry source · Checked 2026-10-26	Not documented in the reviewed source.Private Packagist: npm registry source · Reviewed 2026-10-26
Self-hosting	Cloudflare Workers or Node. Build the container image from the repository; image publishing is planned.Package Broker: self-hosting source · Checked 2026-10-26	Hosted service or a self-hosted edition.Private Packagist: self-hosting source · Checked 2026-10-17
Licence	AGPL-3.0-only.Package Broker: licence source · Checked 2026-10-26	Commercial licence. Self-Hosted starts with a trial agreement, then a quote.Private Packagist: licence source · Checked 2026-10-26
Price model	Your Cloudflare plan or host, storage and operations.Plan: Self-hostedPackage Broker: price model source · Checked 2026-10-26	Per user and suborganization; self-hosted pricing by quote.Plan: Cloud / Self-HostedPrivate Packagist: price model source · Checked 2026-10-17

Moving from Private Packagist

Read the migration guide before switching your projects.

Migrate from Private Packagist Start the quickstart

About this comparison

Private Packagist, Satis and Packeton are names or trademarks of their respective owners. Package Broker is not affiliated with or endorsed by those projects. This comparison uses the sources and review dates shown; features, plans and terms can change. Confirm current terms with each provider before choosing a product.