Deplo

Authentication

Session cookie, API token or OAuth access token, all resolving to the same per-request identity and team scope.

Three ways to authenticate, all resolving to the same per-request identity and team scope.

Browser, same-origin. The web app calls the API same-origin; the Better Auth session cookie (deplo.session_token, __Secure- prefixed over https) is sent automatically. You never handle tokens in the UI. The active team comes from the deplo_team cookie.

If the account has two-factor authentication, login returns requiresTwoFactor: true and no session. Finish with verifyTwoFactorLogin. Full operation reference: see Session and login.

Unauthenticated requests resolve me to null and are rejected by any field that requires a login (Not authorized to resolve <field>).

See also

API tokens

Creating, scoping and revoking a token

Session and login

The operations behind the session cookie

Authorization

Capabilities and instance-admin operations

API tokens and OAuth

The same model, from the dashboard

Did this page help you?

API reference

GraphQL, the REST exceptions, the deploy hook and the MCP server.

API tokens

Creating, scoping, updating and revoking a token, the full lifecycle behind Settings -> API tokens.

On this page

See also