Deplo
Getting started

Authentication

How to authenticate with the deplo.sh API, CLI, and SDK.

deplo.sh supports two authentication methods: JWT sessions (web dashboard only) and API tokens (CLI, agents, CI, and scripts).

JWT sessions (web dashboard)

JWT sessions are used exclusively by the web dashboard. JWTs are short-lived (15 minutes) and automatically refreshed using a long-lived refresh token. They are not used by the CLI.

API tokens (sk_live_)

The recommended method for agents, CI pipelines, and programmatic access. Tokens are scoped and never expire unless you revoke them.

Creating a token

Via the CLI:

deplo tokens create "My Agent" --scopes deploy
# ✔ Token created (shown once):
# sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Via the dashboard: Navigate to TokensNew Token, select scopes, and copy the token on creation.

Caution: The raw token value is shown only once at creation time. Store it immediately in your secrets manager.

Using a token

Environment variable (recommended):

export DEPLO_KEY=sk_live_xxxxxxxxxxxxxxxx
deplo deploy report.html --project weekly-report

CLI flag:

deplo login --token sk_live_xxxxxxxxxxxxxxxx

HTTP Authorization header:

curl -H "Authorization: Bearer sk_live_xxxxxxxxxxxxxxxx" \
  https://api.deplo.sh/workspaces

Token scopes

ScopePermissions
deployCreate new deployments
readList projects, deployments, and tokens
deleteArchive deployments and delete projects
adminFull access including member and token management

Tokens can be workspace-scoped (access all projects) or project-scoped (access a single project only).

Environment variables

VariableDescription
DEPLO_KEYsk_live_ token. When set, all commands authenticate with this token.
DEPLO_API_URLOverride the API base URL. Defaults to https://api.deplo.sh.

Security recommendations

  • Use the minimum required scope for each token
  • Rotate tokens regularly for long-running services
  • Use project-scoped tokens when a process only needs access to a single project
  • Store tokens in your CI/CD secret store (GitHub Actions secrets, Railway variables, etc.) — never commit them to source control

What's next?

  • Quickstart — deploy your first file using the CLI
  • API Tokens — detailed token management (create, revoke, expiry)
  • REST API — use tokens with the HTTP API directly
  • Core Concepts — understand workspaces, projects, and scopes

On this page