Authentication
How to authenticate with the deplo.sh API, CLI, and SDK.
deplo.sh supports two authentication methods: JWT sessions (web dashboard only) and API tokens (CLI, agents, CI, and scripts).
JWT sessions (web dashboard)
JWT sessions are used exclusively by the web dashboard. JWTs are short-lived (15 minutes) and automatically refreshed using a long-lived refresh token. They are not used by the CLI.
API tokens (sk_live_)
The recommended method for agents, CI pipelines, and programmatic access. Tokens are scoped and never expire unless you revoke them.
Creating a token
Via the CLI:
deplo tokens create "My Agent" --scopes deploy
# ✔ Token created (shown once):
# sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxVia the dashboard: Navigate to Tokens → New Token, select scopes, and copy the token on creation.
Caution: The raw token value is shown only once at creation time. Store it immediately in your secrets manager.
Using a token
Environment variable (recommended):
export DEPLO_KEY=sk_live_xxxxxxxxxxxxxxxx
deplo deploy report.html --project weekly-reportCLI flag:
deplo login --token sk_live_xxxxxxxxxxxxxxxxHTTP Authorization header:
curl -H "Authorization: Bearer sk_live_xxxxxxxxxxxxxxxx" \
https://api.deplo.sh/workspacesToken scopes
| Scope | Permissions |
|---|---|
deploy | Create new deployments |
read | List projects, deployments, and tokens |
delete | Archive deployments and delete projects |
admin | Full access including member and token management |
Tokens can be workspace-scoped (access all projects) or project-scoped (access a single project only).
Environment variables
| Variable | Description |
|---|---|
DEPLO_KEY | sk_live_ token. When set, all commands authenticate with this token. |
DEPLO_API_URL | Override the API base URL. Defaults to https://api.deplo.sh. |
Security recommendations
- Use the minimum required scope for each token
- Rotate tokens regularly for long-running services
- Use project-scoped tokens when a process only needs access to a single project
- Store tokens in your CI/CD secret store (GitHub Actions secrets, Railway variables, etc.) — never commit them to source control
What's next?
- Quickstart — deploy your first file using the CLI
- API Tokens — detailed token management (create, revoke, expiry)
- REST API — use tokens with the HTTP API directly
- Core Concepts — understand workspaces, projects, and scopes