CLI Reference
deploro is the terminal client for the platform — every command here calls the
same REST API documented separately. Credentials are stored
in ~/.deploro/credentials.json.
Install & login
npm install -g @deploro/cliLog in to Deploro. Pass --token with a personal access token from Dashboard → Settings → Tokens to skip the interactive prompt.
| --url <url> | Worker base URL (defaults to the production API) |
| --token <token> | Personal access token |
Log out and clear local credentials.
Projects
List your projects.
Create a new project and set it active.
| --slug <slug> | Project slug (derived from name if omitted) |
| --repo <url> | Public repo URL to link (no embedded tokens — for a private repo or auto-deploy on push, use github connect + repo link instead) |
| --branch <branch> | Git branch to deploy from |
deploro create "My App" --slug my-appSet the active project — accepts an id, slug, or name.
Delete a project and its database. Accepts id, slug, or name.
db
Database commands — act on the active project.
Provision the active project's database (idempotent).
Show database status and how to reach it from a deployed app.
List tables in the active project.
List rows in a table.
| --limit <n> | Rows per page (max 200, default 20) |
| --page <n> | Page number (default 1) |
| --json | Output raw JSON |
Run a SQL query (admin). Read-only SELECT only — DDL is blocked.
deploro db query "select id, email from users limit 5"Show schema for a table.
Insert a row. --data is required, a JSON object.
deploro db insert todos --data '{"title":"Ship it","done":false}'Update a row by id. --data is required, a JSON object of fields to update.
Delete a row by id.
Drop a table and all its data (admin).
migrate
Database migration commands.
Register a new migration (admin).
deploro migrate create add_todos --up-file ./up.sql --down-file ./down.sqlList migrations for the active project.
Apply a pending migration (admin).
Roll back an applied migration (admin).
Delete an unapplied migration (admin).
deploy
Deployment commands for the Worker/Pages target — see vps for the separate VPS-compute deploy pipeline. deploy status/deploy logs read the unified timeline, so they also surface VPS-only deployments.
Trigger a manual deployment.
Show latest deployment status.
Show logs for a deployment (defaults to latest).
github
Account-level GitHub OAuth connection — one per platform user. Distinct from repo, which links a specific repo to the active project.
Show whether your GitHub account is connected.
Print the URL to open in a browser to connect GitHub.
List repos your connected GitHub account can access.
Remove your stored GitHub OAuth token.
repo
The active project's connected repo (auto-deploy from GitHub). Requires github connect first.
Show the active project's linked repo.
Link a repo — auto-creates its push webhook for auto-deploy.
deploro github connect
deploro repo link my-org/my-app --branch mainUnlink the repo and remove its GitHub webhook.
Toggle automatic deployment on push.
domains
Self-service custom domains for the active project.
List custom domains.
Add a domain — prints the CNAME + TXT records to create at your DNS provider.
Verify DNS ownership and register SSL.
Poll domain verification/SSL status.
Remove a domain.
hosting
Show Worker and VPS health.
Show recent VPS CPU/memory/disk sparklines.
List secret names set on the active project's Worker — values are never returned.
Set a Worker secret.
vps
VPS compute hosting — raw Postgres/Redis with a real connection string, and custom docker-compose deploys, distinct from the Worker/Pages deploy pipeline and from hosting, which only manages Worker secrets. See the API reference for the underlying routes.
Closed to new projects. Every command below requires the active project to
be one of a small set of pre-existing projects individually approved for direct VPS access —
every command in this group returns 403 otherwise. There is no self-service way
to opt a project in. Everything else on Deploro (db, migrate,
deploy, hosting) stays fully managed — nothing it
does ever writes to the VPS directly.
vps database
Raw Postgres — a dedicated container with a real connection string, for drizzle-kit, transactions, etc.
Provision raw Postgres (idempotent; connection string shown once).
Show raw Postgres connection info (no password).
Rotate the raw Postgres password.
vps redis
Raw Redis — for BullMQ, ioredis, Lua EVAL scripts.
Provision raw Redis (idempotent; connection string shown once).
Show raw Redis connection info (no password).
Rotate the raw Redis password (recreates the container).
vps allowlist
IP allowlist gating access to raw Postgres/Redis ports.
List allowlist entries.
Allow an IP or CIDR block, e.g. 203.0.113.4 or 203.0.113.0/24.
Remove an allowlist entry.
vps env & deploy
List VPS-scoped env var names set on the active project — values are never returned.
Set a VPS-scoped env var (e.g. JWT_SECRET) — distinct from hosting set-env, which sets Worker secrets.
Build and start the active project's docker-compose stack on the VPS.
List VPS deploy history.
Show a VPS deployment's status and logs (defaults to latest).
Show running compute services + raw Postgres/Redis container status.
Tail logs for a compute service (or 'postgres'/'redis'). --tail defaults to 200 lines.
storage
R2 file storage for the active project.
List stored files.
Upload a local file. --key defaults to the local file's name.
Download a stored file. --out defaults to the file's name.
Delete a stored file.
webhooks
Outbound event webhooks for the active project.
List webhooks.
Create a webhook. --events is a comma-separated list of event names (default: test).
Update a webhook.
Delete a webhook.
Fire a test payload.
Show the last 30 delivery attempts.
team
Manage the active project's team members — distinct from auth, which manages platform-wide users.
List project members.
Add an existing Deploro user to this project.
Remove a member from this project.
auth
Auth management commands — platform users, plus the active project's Auth-as-a-Service configuration.
Show the current identity, and — for a token login — exactly what it's scoped to.
List platform users.
Invite a user by email.
Ban a platform user — blocks sign-in immediately, no session revocation needed. Omit --days for an indefinite ban.
Lift a ban.
Get or set the active project's Auth Site URL — where end-user confirmation-email links redirect back to. --clear falls back to the project's own deployment URL.
Show Auth-as-a-Service stats for the active project's end users.
auth providers
Manage the active project's end-user sign-in providers. email (OTP) and email_password are independent providers, each with its own toggle and its own end-user identities — neither takes OAuth credentials.
List sign-in providers and their status.
Enable a sign-in provider, e.g. email, email_password, google, github, apple...
Disable a sign-in provider.
Set OAuth client credentials for a provider (not applicable to email / email_password). --team-id and --key-id are Apple-only; --client-secret is the .p8 private key contents for Apple.
auth end-users
Manage the active project's end users — the people who signed up inside your app. Distinct from auth users above, which lists platform users (people with dashboard access).
List end users.
Manually add an end user — sends a confirmation email; they can't sign in until they click it.
Delete an end user and all their sign-in methods/sessions.
token
Personal access token commands — requires a browser-session login, not a PAT.
List your personal access tokens.
Create a new project-scoped personal access token.
| --read | Grant read scope |
| --write | Grant write scope |
| --project <slugs> | Comma-separated project slugs/ids/names (defaults to the active project) |
| --days <n> | Expiry in days, 1-365 (default 90) |
deploro token create ci-deploy --write --project my-app --days 30Revoke a personal access token.