CLI Reference

Log in to Deploro. Opens your browser, where you check that the code matches the one in your terminal and click Authorize. You never type your password in the terminal. Over SSH, open the printed URL on any device. For CI or servers, pass --token with a personal access token from Dashboard → Settings → Tokens.

Log out and clear local credentials.

List your projects.

Create a new project and set it active.

deploro create "My App" --slug my-app

Set the active project. Accepts an id, slug, or name.

Delete a project and its database. Accepts id, slug, or name.

Provision the active project's database (idempotent).

Show database status and how to reach it from a deployed app.

List tables in the active project.

List rows in a table.

Run a SQL query (admin). Read-only SELECT only; DDL is blocked.

deploro db query "select id, email from users limit 5"

Show schema for a table.

Insert a row. --data is required, a JSON object.

deploro db insert todos --data '{"title":"Ship it","done":false}'

Update a row by id. --data is required, a JSON object of fields to update.

Delete a row by id.

Drop a table and all its data (admin).

Register a new migration (admin).

deploro migrate create add_todos --up-file ./up.sql --down-file ./down.sql

List migrations for the active project.

Apply a pending migration (admin).

Roll back an applied migration (admin).

Delete an unapplied migration (admin).

Write TypeScript types for every table (Row, Insert, Update), SQL function (Args, Returns) and enum in the project database. Prints to stdout unless --out is given. Re-run it after each migration. bigint, numeric and money columns are strings in Row, because the API returns them as strings so large values keep their precision.

deploro gen types --out src/database.types.ts

import type { Tables, TablesInsert } from "./database.types";
const todo: TablesInsert<"todos"> = { title: "Ship it" };

Trigger a manual deployment. Deploro builds the connected repo and publishes its build output. See How deploys work for which directory is published and why a Next.js app needs a static export or the OpenNext adapter.

Show latest deployment status. If the latest deploy failed, the failure reason is printed inline along with the exact deploro deploy logs <id> command for the full build transcript. See How deploys work.

Show logs for a deployment (defaults to latest). With --site, the latest deployment of that site. Without it, every deploy command uses the main site.

List the project's sites with their repository, root directory, address and last deploy.

Add a site (admin). With --repo it links the repository and starts the first deploy. In a monorepo, --root is the site's folder: pushes that don't change anything under it don't redeploy it. Dependencies install from the repository root when the site's folder has no lockfile of its own.

deploro sites create "Marketing site" --slug web --repo acme/rowwise --root apps/web
deploro zones attach rowwise.com --site web
deploro zones attach app.rowwise.com --site main

Change a site's settings (admin). main is the main site. An empty string resets a command back to auto-detection. Takes effect on the next deploy.

Remove a site (admin): its deployments, preview address and hostnames go with it. The main site can't be removed.

Show whether your GitHub account is connected.

Print the URL to open in a browser to connect GitHub.

List repos your connected GitHub account can access.

Remove your stored GitHub OAuth token.

Show the active project's linked repo.

Link a repo. Its push webhook for auto-deploy is created automatically. --site links it to one of the project's sites instead of the main site; several sites can share one repository, and so can several projects (each gets its own webhook).

deploro github connect
deploro repo link my-org/my-app --branch main

Unlink the repo and remove its GitHub webhook.

Toggle automatic deployment on push.

List custom domains.

Add a domain. Prints the CNAME and TXT records to create at your DNS provider.

Verify DNS ownership and register SSL.

Poll domain verification/SSL status.

Remove a domain.

Sending domains, sender addresses, and recipients sent to today.

Set up a managed domain for sending. Deploro adds the DKIM, SPF and bounce records. --subdomain mail sends from mail.yourdomain.com instead.

Stop sending from a domain. Its sender addresses are removed.

Allow sending from an address such as hello@yourdomain.com. Apps can only send from addresses added here.

Remove a sender address.

Send the project's sign-in, magic-link, confirmation and password-reset emails from this address. off goes back to auth@deploro.com.

Send one email. Counts against the project's daily recipient limit (100 by default).

Recent emails sent through the API (kept 30 days).

Create the widget and print its site key. Domains default to the project's own hostnames. --test and --always-fail make a local-development widget on Cloudflare's test keys, which doesn't count against the limit. Redeploy afterwards to get TURNSTILE_SITE_KEY on the Worker.

Widgets with site key, name, mode, domains and created date. Never the secret.

One widget's details.

--domain replaces the whole domain list. Each entry must be one of the project's hostnames, up to 10.

Issue a new secret. The old one keeps working for about 2 hours unless --immediate. Your app needs no change.

Delete the widget. Forms using it stop passing checks.

Recent checks: outcome, action, hostname, error codes (kept 30 days).

Show Worker and VPS health.

Show recent VPS CPU/memory/disk sparklines.

List secret names set on the active project's Worker. Values are never returned.

Set a Worker secret.

Provision raw Postgres (idempotent; connection string shown once).

Show raw Postgres connection info (no password).

Rotate the raw Postgres password.

Provision raw Redis (idempotent; connection string shown once).

Show raw Redis connection info (no password).

Rotate the raw Redis password (recreates the container).

List allowlist entries.

Allow an IP or CIDR block, e.g. 203.0.113.4 or 203.0.113.0/24.

Remove an allowlist entry.

List VPS-scoped env var names set on the active project. Values are never returned.

Set a VPS-scoped env var (e.g. JWT_SECRET). Separate from hosting set-env, which sets Worker secrets.

Build and start the active project's docker-compose stack on the VPS.

List VPS deploy history.

Show a VPS deployment's status and logs (defaults to latest).

Show running compute services + raw Postgres/Redis container status.

Tail logs for a compute service (or 'postgres'/'redis'). --tail defaults to 200 lines.

List stored files.

Upload a local file. --key defaults to the local file's name. Files over 50MB go up in parts (up to 5GB), with a failed part retried on its own.

Continue an interrupted upload of the same file, sending only the parts the server doesn't have. A failed upload prints this command with its id. Unfinished uploads expire after 24 hours.

Give up on an interrupted upload and delete the parts sent so far.

Download a stored file. --out defaults to the file's name.

Delete a stored file.

Turn unauthenticated inline reads on or off for the active project, or show the current setting. When on, objects are served at /files/{slug}/{key} to anyone who knows the key. Off by default.

Generate a time-limited public URL for one file. Works even for a private bucket or a private project root, since the signature itself grants access until it expires. --expires accepts a bare number of seconds or a short duration like 30m, 1h, 7d (default 1h, max 7d).

List buckets.

Create a bucket. Private by default.

Toggle a bucket's unauthenticated read access.

Remove a bucket's access policy. Files already stored under it are kept; this only removes the policy row.

Give every file already in the bucket a row in _deploro_storage_objects, so your storage policies can let end users reach it. Files uploaded through the dashboard, CLI or API get one automatically; run this for files uploaded before storage policies existed.

Upload into an existing bucket instead of the project root. The bucket must already exist.

List webhooks.

Create a webhook. --events is a comma-separated list of event names (default: test).

Update a webhook.

Delete a webhook.

Fire a test payload.

Show the last 30 delivery attempts.

List project members.

Add an existing Deploro user to this project.

Remove a member from this project.

Show the current identity and, for a token login, exactly what it's scoped to.

List platform users.

Invite a user by email.

Ban a platform user. Blocks sign-in immediately, no session revocation needed. Omit --days for an indefinite ban.

Lift a ban.

Get or set the active project's Auth Site URL: where end-user confirmation-email links redirect back to. --clear falls back to the project's own deployment URL.

Block or allow new end-user sign-ups from temporary/disposable email addresses (mailinator.com, 10minutemail.com and about 10,000 more) on the active project. With no argument, shows whether blocking is on and how current the list is. Applies to email and password signups, social/SSO sign-ins that would create a new account, and users you add yourself; existing users keep signing in. A refused signup gets a 400 with code TEMPORARY_EMAIL. Same switch as Block temporary email addresses on the dashboard's Auth page. Alias: disposable-emails.

Check whether an address is on the temporary email list, and whether this project would refuse it.

Show Auth-as-a-Service stats for the active project's end users.

List sign-in providers and their status.

Enable a sign-in provider, e.g. email, email_password, google, github, apple...

Disable a sign-in provider.

Set OAuth client credentials for a provider (not applicable to email / email_password). --team-id and --key-id are Apple-only; --client-secret is the .p8 private key contents for Apple.

List end users.

Manually add an end user. Sends a confirmation email; they can't sign in until they click it.

Delete an end user and all their sign-in methods/sessions.

List your personal access tokens.

Create a new project-scoped personal access token.

deploro token create ci-deploy --write --project my-app --days 30

Revoke a personal access token.