How do I install Magento 2 using Composer instead of a downloaded archive?

You install Magento 2 with Composer by running composer create-project against Adobe’s repository at repo.magento.com. Your Adobe Commerce Marketplace access keys act as the username and password for that repository. Composer downloads the code and dependencies, then bin/magento setup:install creates the database and admin account. Unlike an archive, the result is a codebase you patch and extend through Composer.

Why install Magento 2 with Composer instead of a zip archive?

A downloaded archive is a frozen snapshot, so every patch means overwriting files by hand. A Magento 2 Composer installation records exact versions in composer.lock, and every environment builds from that file.

Steps to install Magento 2 with Composer

Step 1: Check the Magento 2.4.9 system requirements

Check PHP, the database, the search engine, and Composer before downloading anything. As of October 2026, Magento 2.4.9 is the latest minor release, out since May 12, 2026.

• Magento 2.4.9 fully supports PHP 8.5, and Adobe’s 2.4.9 release notes allow PHP 8.4 for upgrades only.
• Adobe recommends OpenSearch 3.x for 2.4.9, and OpenSearch 2.x still works.
• Database and Composer versions follow Adobe’s system requirements page.
• If Composer 2 isn’t on the server yet, install it from getcomposer.org and check it with composer --version.

Step 2: Get your Marketplace access keys

Sign in to Adobe Commerce Marketplace and create an access key pair under your profile. Magento Open Source is free, but repo.magento.com still requires authentication. Keep the keys out of your repository. Store them in a Composer auth.json file outside version control, or in an environment variable.

Step 3: Run composer create-project

From the directory where the store should live, run the command below. Pin the version so every environment you build later gets the same release:

composer create-project --repository-url=https://repo.magento.com/ magento/project-community-edition=2.4.9 my-store

To install into the current directory instead, replace my-store with a dot (.). The directory must be empty. For Adobe Commerce, swap the package name for magento/project-enterprise-edition.

After you enter your keys, Composer asks whether to save the credentials. Say yes only on a machine you control. If auth.json already holds your keys, Composer skips the login prompt.

If the download stops with a memory error, lift PHP’s limit for that one run:

php -d memory_limit=-1 $(which composer) create-project --repository-url=https://repo.magento.com/ magento/project-community-edition=2.4.9 my-store

Step 4: Set file permissions

The web server group needs write access to var, generated, vendor, pub/static, pub/media, and app/etc. Adobe’s quick start uses these commands:

cd my-store
find var generated vendor pub/static pub/media app/etc -type f -exec chmod g+w {} +
find var generated vendor pub/static pub/media app/etc -type d -exec chmod g+ws {} +
chown -R :www-data .
chmod u+x bin/magento

Replace www-data with your web server’s group if it differs.

Step 5: Run bin/magento setup:install

Create an empty database and a database user with full privileges on it first. Then run the installer:

bin/magento setup:install \
  --base-url=https://example.com/ \
  --db-host=localhost --db-name=magento \
  --db-user=magento --db-password=yourpassword \
  --admin-firstname=Admin --admin-lastname=User \
  [email protected] \
  --admin-user=admin --admin-password=StrongPass123 \
  --language=en_US --currency=USD --timezone=America/Chicago \
  --use-rewrites=1 \
  --search-engine=opensearch \
  --opensearch-host=localhost --opensearch-port=9200

For the full list of flags, check bin/magento help setup:install.

Step 6: Finish the setup

• Install cron with bin/magento cron:install so indexing and emails actually run.
• Production stores belong in production mode: bin/magento deploy:mode:set production.
• Two-factor authentication is on by default, so your first admin login asks you to configure it.
• Commit composer.json and composer.lock so every environment builds the same code.

Keeping a Magento 2 Composer install maintainable

Treat composer.json and composer.lock as the source of truth for your Magento store. A PHP or OpenSearch version outside Adobe’s requirements table is the one install failure you can rule out in advance. Check both before running composer create-project. If you are moving an older archive-based store onto Composer, our Magento development team can plan that conversion.