Install

Install the deplane CLI, log in with your passkey, and check your setup.

Deplane is in an invite-only beta. You need an approved account to log in. Request access at https://deplane.io/beta.

Install the CLI

The CLI is one binary for macOS (Apple silicon and Intel), Linux (x86-64 and Arm64), and Windows (x86-64). Every release is signed: its list of SHA-256 sums carries Deplane's signature. Every install method below gets the same binary. The binaries themselves are not code-signed for Windows or notarized for macOS yet, so Windows SmartScreen may warn about the download.

The first public release of the CLI is on its way. Until it is out, the message we send when you are approved tells you how to get the CLI.

Install script

On macOS and Linux:

curl -fsSL https://deplane.io/install | sh

The script picks the build for your computer and downloads it from https://deplane.io/cli/. Before it installs anything, it checks two things:

The release's list of SHA-256 sums carries a valid signature from Deplane's release key. The key is built into the script. The version to install comes from that signed list too.
The download matches its sum on that signed list.

If either check fails, the script stops and installs nothing. It needs curl, tar, and ssh-keygen from OpenSSH 8.2 or newer. macOS and current Linux distributions include all of them. GNU wget works instead of curl.

It installs deplane into ~/.local/bin if that folder is on your PATH, or else into /usr/local/bin if you can write to it. It asks before it uses sudo, and without a terminal it never does. It does not replace a newer deplane in that folder, or one Homebrew installed. To choose for yourself:

Variable	What it does
`DEPLANE_INSTALL_DIR`	Install into this folder.
`DEPLANE_VERSION`	Install this version instead of the newest, such as `0.1.0`. This is also how you go back to an older version.

To update, run the script again.

Homebrew

brew install deplane-cloud/tap/deplane

The Homebrew tap opens with the first public release.

npm

After the first npm release, this will work:

npx @deplane/cli version

The @deplane/cli package holds no binary. On its first run it downloads the release of its own version and checks the signature and the sum the same way the install script does. It keeps the binary in your cache folder and checks it again before each run. It needs Node.js 20 or newer, and it does not use HTTPS_PROXY: behind a proxy, use the install script.

The npm package is not published yet. Until it is, do not install any other package that claims to be the Deplane CLI.

Windows

Download deplane_VERSION_windows_amd64.zip from https://deplane.io/cli/VERSION/, where VERSION is the newest version: the version in the file names at https://deplane.io/cli/latest. Check it as shown below, unzip it, and put deplane.exe in a folder on your PATH. The check needs Windows 11, or OpenSSH 8.2 or newer on Windows 10. After the first npm release, npx @deplane/cli works on Windows too.

Check a download yourself

Every release has a list of SHA-256 sums, SHA256SUMS, and its signature, SHA256SUMS.sig, made with Deplane's release key:

ssh-ed25519 NO_KEY_YET

Its fingerprint is SHA256:NO_KEY_YET. The same key is in the install script and the npm package. It is also published on GitHub, apart from Deplane's own servers, at https://github.com/deplane-cloud/homebrew-tap. If the two differ, do not install, and write to security@deplane.io.

https://deplane.io/cli/latest is the newest release's SHA256SUMS followed by its signature. To check a download by hand, here for Linux on x86-64:

V=$(curl -fsSL https://deplane.io/cli/latest | sed -n 's/.*  deplane_\([^_]*\)_linux_amd64\.tar\.gz$/\1/p')
for f in SHA256SUMS SHA256SUMS.sig "deplane_${V}_linux_amd64.tar.gz"; do
  curl -fsSLO "https://deplane.io/cli/$V/$f"
done
echo "release@deplane.io ssh-ed25519 NO_KEY_YET" > deplane-release.allowed
ssh-keygen -Y verify -f deplane-release.allowed -I release@deplane.io -n deplane-cli -s SHA256SUMS.sig < SHA256SUMS
grep "deplane_${V}_linux_amd64.tar.gz" SHA256SUMS | sha256sum -c

ssh-keygen prints Good "deplane-cli" signature for release@deplane.io, and sha256sum prints OK. On macOS, use shasum -a 256 -c instead of sha256sum -c. If the key above reads NO_KEY_YET, the first release is not out yet.

On Windows, in PowerShell, with VERSION set to the newest version:

$V = "VERSION"
foreach ($f in "SHA256SUMS", "SHA256SUMS.sig", "deplane_${V}_windows_amd64.zip") { Invoke-WebRequest "https://deplane.io/cli/$V/$f" -OutFile $f }
Set-Content -Encoding ascii -NoNewline deplane-release.allowed "release@deplane.io ssh-ed25519 NO_KEY_YET"
cmd /c "ssh-keygen -Y verify -f deplane-release.allowed -I release@deplane.io -n deplane-cli -s SHA256SUMS.sig < SHA256SUMS"
(Get-FileHash -Algorithm SHA256 "deplane_${V}_windows_amd64.zip").Hash.ToLower()
Select-String windows_amd64.zip SHA256SUMS

ssh-keygen prints the same Good line. The sum Get-FileHash prints must be the one on the zip's line in SHA256SUMS.

What the checks protect against

A download changed on the way, on a mirror, or among the releases on the server: its sum does not match the signed list, and the install stops.
A list changed or signed by anyone but Deplane: the signature does not match.
What they do not cover: the install script and its key come from the same server as the releases. Someone who took over that server could change the script and its key together, and curl | sh would run their script. Deplane watches for that from a separate server, which compares the live script with the published one every few minutes. To rule it out yourself, check the key against the copy on GitHub first, or install with Homebrew, whose formula pins each download's sum in a GitHub repository.
Someone who controls the server could also offer an older genuine release as the newest one. The install script never replaces a newer deplane with it, and DEPLANE_VERSION installs exactly the version you name.

After installing

Check that it works:

$ deplane version
deplane 0.1.0

With --json:

{
  "version": "0.1.0"
}

Log in

deplane login

The CLI shows an 8-character code and opens https://app.deplane.io/device in your browser:

$ deplane login

To log in, open https://app.deplane.io/device and type this code:

    WDJB-MJHT

Only approve it if you just ran this command yourself. The code expires in 10 minutes.

Logged in as you@example.com (organization you-example).

What happens in the browser:

You sign in, with your passkey if you have one.
You type the code from your terminal. The page never fills it in for you from a link, so nobody can trick you into approving their request with a link.
The page shows where the request came from: the IP address, an approximate location, the CLI version, and the time. Approve it only if you just ran deplane login yourself.
You confirm with your passkey.

The CLI stores its token in your operating system's keychain. If there is no keychain, it stores the token in a file in your config folder that only you can read, and tells you where. A CLI login lasts 30 days. You can revoke a login at once. Email notices of new logins are not sent yet, because email sending is not set up.

If you do not have a passkey yet, the first sign-in link we send you when you are approved walks you through creating one. You can use an authenticator app instead if your device has no passkey support. A second factor is always required.

Check who you are logged in as:

$ deplane whoami
Logged in as you@example.com
Organization: You (you-example)

To log out, run deplane logout. It revokes the token and removes it from this computer.

Environment variables

Variable	What it does
`DEPLANE_TOKEN`	Use this token instead of the stored login. For CI, agents, and scripts. Create one with `deplane tokens create`.
`DEPLANE_API_URL`	The API to use. Default `https://api.deplane.io`.

When DEPLANE_TOKEN is set, deplane login refuses to run, because the stored login would not be used. Unset it first. See Agents, CI, and scripts for how to use tokens.

Check your setup

deplane doctor checks that the API answers, that you are logged in, and whether the current folder is a project Deplane can build. It explains any problem and how to fix it.

$ deplane doctor
ok   api      The Deplane API at https://api.deplane.io answers.
ok   login    Logged in as you@example.com.
ok   project  Detected Next.js 15, Node 22, port 3000.
ok   config   No deplane.toml here; `deplane launch` writes one.

Next, deploy your first app with the Quickstart.

This page is also available as Markdown. AI agents can start at /llms.txt.