Authentication
Session cookie, API token or OAuth access token. All three resolve to one identity acting in one team.
Three credentials, one model: every request resolves to a principal (a person or a token) acting in one team, and every query and mutation is filtered to that team.
For CI, scripts and your own tooling. Create one under Settings -> API tokens. It is shown once. Send it as a bearer token:
curl https://deplo.example.com/api/graphql \
-H "Authorization: Bearer deplo_xxxxxxxxxxxxxxxxxxxxxxxx" \
-H "Content-Type: application/json" \
-H "X-Deplo-Team: acme" \
-d '{"query":"{ viewerTeam { slug } apps { slug status } }"}'Picking the team. X-Deplo-Team takes a team id or slug. Without it, the first team in the token's scope is used. A team the token does not hold is ignored, not honoured. myTeams lists the ones it may switch between.
What it can do. The capabilities chosen at creation, capped by what its owner can still do in that team. A token that names no capabilities is view-only. The full lifecycle is on API tokens.
What it can never do. A token is a principal of its own, never a stand-in for the person who minted it. Every personal-account operation on Account answers An API token can't access <that resource>, whatever the token holds.
Unauthenticated requests
me resolves to null. Anything else that needs a login fails with Not authorized to resolve <field>. The only public operations are the sign-in and registration mutations, listed as such on their pages.
Gates
Every operation in this reference states who may call it, in one of four forms:
| Line | Meaning |
|---|---|
Needs deploy_apps | The principal must hold that capability in the active team. Some add "or instance admin". |
| Instance admin only | A global instance admin. For a token, instance admin is opt-in per token, never inherited from its owner. |
| Any signed-in principal | A session or a token, any capabilities. |
| Public, no authentication | Sign-in and registration. |
A capability gate is the same one the dashboard button behind it uses. A token or a role narrowed to part of a team (a folder, a project, an app) is refused by team-wide operations in that team, members and roles included.
See also
Did this page help you?