If I need to rotate my GitHub token or Private Packagist/Artifactory authentication, I would like to do it in one place. NPM supports using environment variables in the .npmrc file but I do not see that Composer also supports it in auth.json files. I propose that we add environment variable support so that I could do the following:

{
    "github-oauth": {
        "github.com": "${GITHUB_TOKEN}"
    },
    "http-basic": {
        "packages.mycompany.com": {
            "username": "[email protected]",
            "password": "${PACKAGIST_MY_COMPANY_PASSWORD}"
        }
    }
}

This would allow me to re-use the same variables across Composer and NPM since we use Artifactory for both at the current project I work at, and I only have to update them in once place (my .zshenv file).