You could use this Composer plugin to manage private packages: private-composer-installer see it here. In your composer.json add
{
"type": "composer",
"url": "https://packages.metabox.io/{%MB_KEY}"
}
under the "repositories" key.
Require the plugin
"ffraenz/private-composer-installer": "^5.0"
Then in your .env file add your license, e.g: MB_KEY='xxxxx'