CLI Reference
deploro is the terminal client for the platform. Every command here calls the
same REST API documented separately. Credentials are stored
in ~/.deploro/credentials.json.
Install & login
npm install -g deploroLog in to Deploro. Pass --token with a personal access token from Dashboard → Settings → Tokens to skip the interactive prompt.
| --url <url> | Worker base URL (defaults to the production API) |
| --token <token> | Personal access token |
Log out and clear local credentials.
Projects
List your projects.
Create a new project and set it active.
| --slug <slug> | Project slug (derived from name if omitted) |
| --repo <url> | Public repo URL to link (no embedded tokens; for a private repo or auto-deploy on push, use github connect + repo link instead) |
| --branch <branch> | Git branch to deploy from |
deploro create "My App" --slug my-appSet the active project. Accepts an id, slug, or name.
Delete a project and its database. Accepts id, slug, or name.
db
Database commands. They act on the active project.
Provision the active project's database (idempotent).
Show database status and how to reach it from a deployed app.
List tables in the active project.
List rows in a table.
| --limit <n> | Rows per page (max 200, default 20) |
| --page <n> | Page number (default 1) |
| --json | Output raw JSON |
Run a SQL query (admin). Read-only SELECT only; DDL is blocked.
deploro db query "select id, email from users limit 5"Show schema for a table.
Insert a row. --data is required, a JSON object.
deploro db insert todos --data '{"title":"Ship it","done":false}'Update a row by id. --data is required, a JSON object of fields to update.
Delete a row by id.
Drop a table and all its data (admin).
migrate
Database migration commands.
Register a new migration (admin).
deploro migrate create add_todos --up-file ./up.sql --down-file ./down.sqlList migrations for the active project.
Apply a pending migration (admin).
Roll back an applied migration (admin).
Delete an unapplied migration (admin).
deploy
Deployment commands for the Worker/Pages target. See vps for the separate VPS-compute deploy pipeline. deploy status/deploy logs read the unified timeline, so they also surface VPS-only deployments.
Trigger a manual deployment. Deploro builds the connected repo and publishes its build output. See How deploys work for which directory is published and why a Next.js app needs a static export or the OpenNext adapter.
Show latest deployment status. If the latest deploy failed, the failure reason is printed inline along with the exact deploro deploy logs <id> command for the full build transcript. See How deploys work.
Show logs for a deployment (defaults to latest).
github
Account-level GitHub OAuth connection, one per platform user. Distinct from repo, which links a specific repo to the active project.
Show whether your GitHub account is connected.
Print the URL to open in a browser to connect GitHub.
List repos your connected GitHub account can access.
Remove your stored GitHub OAuth token.
repo
The active project's connected repo (auto-deploy from GitHub). Requires github connect first.
Show the active project's linked repo.
Link a repo. Its push webhook for auto-deploy is created automatically.
deploro github connect
deploro repo link my-org/my-app --branch mainUnlink the repo and remove its GitHub webhook.
Toggle automatic deployment on push.
domains
Self-service custom domains for the active project.
List custom domains.
Add a domain. Prints the CNAME and TXT records to create at your DNS provider.
Verify DNS ownership and register SSL.
Poll domain verification/SSL status.
Remove a domain.
hosting
Show Worker and VPS health.
Show recent VPS CPU/memory/disk sparklines.
List secret names set on the active project's Worker. Values are never returned.
Set a Worker secret.
vps
VPS compute hosting: raw Postgres/Redis with a real connection string, and custom docker-compose deploys, distinct from the Worker/Pages deploy pipeline and from hosting, which only manages Worker secrets. See the API reference for the underlying routes.
Closed to new projects. Every command below requires the active project to
be one of a small set of pre-existing projects individually approved for direct VPS access;
every command in this group returns 403 otherwise. There is no self-service way
to opt a project in. Everything else on Deploro (db, migrate,
deploy, hosting) stays fully managed, and nothing it
does ever writes to the VPS directly.
vps database
Raw Postgres: a dedicated container with a real connection string, for drizzle-kit, transactions, etc.
Provision raw Postgres (idempotent; connection string shown once).
Show raw Postgres connection info (no password).
Rotate the raw Postgres password.
vps redis
Raw Redis, for BullMQ, ioredis, Lua EVAL scripts.
Provision raw Redis (idempotent; connection string shown once).
Show raw Redis connection info (no password).
Rotate the raw Redis password (recreates the container).
vps allowlist
IP allowlist gating access to raw Postgres/Redis ports.
List allowlist entries.
Allow an IP or CIDR block, e.g. 203.0.113.4 or 203.0.113.0/24.
Remove an allowlist entry.
vps env & deploy
List VPS-scoped env var names set on the active project. Values are never returned.
Set a VPS-scoped env var (e.g. JWT_SECRET). Separate from hosting set-env, which sets Worker secrets.
Build and start the active project's docker-compose stack on the VPS.
List VPS deploy history.
Show a VPS deployment's status and logs (defaults to latest).
Show running compute services + raw Postgres/Redis container status.
Tail logs for a compute service (or 'postgres'/'redis'). --tail defaults to 200 lines.
storage
R2 file storage for the active project, where a project's uploaded files belong, rather than in a database bytea column or on the VPS filesystem, neither of which the dashboard's Storage tab can see. --key accepts slashes, so --key invoices/2026/03.pdf preserves directory structure.
Constraints: upload and delete require project-admin (list and download accept any member); 100MB per file; files whose first bytes look like HTML, SVG, or script are rejected. By default stored objects are readable only by project members; deploro storage public on opts the project into unauthenticated inline reads at /files/{slug}/{key}.
List stored files.
Upload a local file. --key defaults to the local file's name.
Download a stored file. --out defaults to the file's name.
Delete a stored file.
Turn unauthenticated inline reads on or off for the active project, or show the current setting. When on, objects are served at /files/{slug}/{key} to anyone who knows the key. Off by default.
Generate a time-limited public URL for one file. Works even for a private bucket or a private project root, since the signature itself grants access until it expires. --expires accepts a bare number of seconds or a short duration like 30m, 1h, 7d (default 1h, max 7d).
storage buckets
Named groupings within a project's storage, each with its own public/private flag, finer-grained than the single project-wide toggle above. A file uploaded with --bucket <name> lives at {slug}/{bucket}/{key} and is governed by that bucket's own flag instead of the project-wide one.
List buckets.
Create a bucket. Private by default.
Toggle a bucket's unauthenticated read access.
Remove a bucket's access policy. Files already stored under it are kept; this only removes the policy row.
Upload into an existing bucket instead of the project root. The bucket must already exist.
webhooks
Outbound event webhooks for the active project.
List webhooks.
Create a webhook. --events is a comma-separated list of event names (default: test).
Update a webhook.
Delete a webhook.
Fire a test payload.
Show the last 30 delivery attempts.
team
Manage the active project's team members. Separate from auth, which manages platform-wide users.
List project members.
Add an existing Deploro user to this project.
Remove a member from this project.
auth
Auth management commands: platform users, plus the active project's Auth-as-a-Service configuration.
Show the current identity and, for a token login, exactly what it's scoped to.
List platform users.
Invite a user by email.
Ban a platform user. Blocks sign-in immediately, no session revocation needed. Omit --days for an indefinite ban.
Lift a ban.
Get or set the active project's Auth Site URL: where end-user confirmation-email links redirect back to. --clear falls back to the project's own deployment URL.
Show Auth-as-a-Service stats for the active project's end users.
auth providers
Manage the active project's end-user sign-in providers. email (OTP) and email_password are independent providers, each with its own toggle and its own end-user identities. Neither takes OAuth credentials.
List sign-in providers and their status.
Enable a sign-in provider, e.g. email, email_password, google, github, apple...
Disable a sign-in provider.
Set OAuth client credentials for a provider (not applicable to email / email_password). --team-id and --key-id are Apple-only; --client-secret is the .p8 private key contents for Apple.
auth end-users
Manage the active project's end users: the people who signed up inside your app. Distinct from auth users above, which lists platform users (people with dashboard access).
List end users.
Manually add an end user. Sends a confirmation email; they can't sign in until they click it.
Delete an end user and all their sign-in methods/sessions.
token
Personal access token commands. Requires a browser-session login, not a PAT.
List your personal access tokens.
Create a new project-scoped personal access token.
| --read | Grant read scope |
| --write | Grant write scope |
| --project <slugs> | Comma-separated project slugs/ids/names (defaults to the active project) |
| --days <n> | Expiry in days, 1-365 (default 90) |
deploro token create ci-deploy --write --project my-app --days 30Revoke a personal access token.