# Dependencies and environment

Install project dependencies and configure environment values without leaving the Workspace.

## Composer dependencies

Use the Composer interface for common install, update, require, and remove operations. Use the terminal when you need a specialized Composer option, then review both `composer.json` and `composer.lock` before committing.

Private package credentials are secrets. Add them through the supported credentials or environment controls and never commit an auth file containing tokens.

## JavaScript dependencies

Use the package manager selected by the repository lock file or `.phpsandbox/setup.json`. Avoid switching package managers accidentally because that can replace the lock file and produce a different dependency graph.

Configure long-running development servers as setup tasks so PHPSandbox can supervise them.

## Environment values and secrets

Use regular environment values for non-sensitive configuration. Use secrets for API tokens, passwords, private keys, and package credentials. Keep secret values out of diffs, logs, previews, and screenshots.

After changing environment values, restart the affected process. Framework configuration caches may also need to be cleared or rebuilt.

See [Secrets and environment](/docs/sdk/secrets-and-environment) for the programmatic equivalent and [Project setup](/docs/concepts/project-setup) for repository defaults.