Deploying with a Deploy Token

A deploy token lets you push code from your own machine or from a CI pipeline, without connecting GitHub.

New to this? Deploy Your First App — Complete Walkthrough covers the whole process from an empty folder to a live site.

Create a token

1. Open your app and go to the Deploy Tokens tab
2. Click Create Token and give it a name (for example laptop or github-actions)
3. Copy the token immediately

The page then shows a ready-to-run command with your new token already in it. Copy that and you have nothing to edit by hand.

The token is shown once. We store only a hash of it, so we cannot show it again or recover it. If you lose it, delete that token and create another.

You can hold up to 5 tokens per app, and give a token an expiry date. Each token works for that app only — it cannot deploy to any of your other apps.

Deploy your code

It has two steps — package your code, then upload it:

# 1. Package your app
tar czf app.tar.gz -C my-app .

# 2. Upload it with your token
curl -X POST https://deploy.colosoft.com/deploy/your-app-name \
  -H "Authorization: Bearer <YOUR_DEPLOY_TOKEN>" \
  -H "Content-Type: application/gzip" \
  --data-binary @app.tar.gz

Replace <YOUR_DEPLOY_TOKEN> with your token and your-app-name with your app's name — or copy the ready-made command from the Deploy Tokens page, which has both filled in already.

The command waits while your app is built, around 45 seconds for a small app, then returns the result.

Uploads may be up to 512 MB. Do not include node_modules or .git — the platform installs your dependencies itself:

```bash

tar czf app.tar.gz --exclude=node_modules --exclude=.git -C my-app .

```

The upload starts a normal build: dependencies are installed, the app is built, health-checked, and traffic switches over with no downtime.

Watch the build

Go to the Deploys tab to follow the build output and see whether it succeeded.

Using it in CI

Store the token as a secret in your CI system (never commit it to your repository) and run the same two commands as a build step.

Common problems

Security

• Tokens are stored hashed; the plaintext is never kept after creation
• Each token is scoped to one app
• Delete a token the moment it is no longer needed, or if it may have been exposed
• Never commit a token to source control