Deploying with a Deploy Token

A deploy token lets you push code from your own machine or from a CI pipeline, without connecting GitHub.

Create a token

1. Open your app and go to the Deploy Tokens tab
2. Click Create Token and give it a name (for example laptop or github-actions)
3. Copy the token immediately

The token is shown once. We store only a hash of it, so we cannot show it again or recover it. If you lose it, delete that token and create another.

You can hold up to 5 tokens per app, and give a token an expiry date. Each token works for that app only — it cannot deploy to any of your other apps.

Deploy your code

The Deploy Tokens page prints the exact command for your app, with the correct address already filled in. Copy it from there rather than typing it by hand.

It has two steps — package your code, then upload it:

# 1. Package your app
tar czf app.tar.gz -C ./my-app .

# 2. Upload it with your token
curl -X POST <the URL shown on your Deploy Tokens page> \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/gzip" \
  --data-binary @app.tar.gz

The upload starts a normal build: dependencies are installed, the app is built, health-checked, and traffic switches over with no downtime.

Watch the build

Go to the Deploys tab to follow the build output and see whether it succeeded.

Using it in CI

Store the token as a secret in your CI system (never commit it to your repository) and run the same two commands as a build step.

Common problems

Security

• Tokens are stored hashed; the plaintext is never kept after creation
• Each token is scoped to one app
• Delete a token the moment it is no longer needed, or if it may have been exposed
• Never commit a token to source control