Authentication

Every request uses one header: Authorization: Bearer. For a credential, join its Access Key and Secret Key with a colon. Create credentials from the Credentials page in the console.

curl https://api.justdeploy.net/ping \
  -H "Authorization: Bearer YOUR_ACCESS_KEY:YOUR_SECRET_KEY"

The older X-Access-Key and X-Secret-Key headers still work, so an app already running on them keeps working and needs no new build. Use the single header for anything new.

"pong"

Going without the SDK, keys are not injected for you: issue an app key and register it as the project environment variables JUSTDEPLOY_ACCESS_KEY and JUSTDEPLOY_SECRET_KEY before you build, because variables are baked into the image at build time. Read them from process.env and never hardcode a key in your source.

AI tools connected through MCP use a user-scoped PAT issued through Copy MCP setup or OAuth. It covers every organization the user can access. The MCP client manages this authentication; do not copy its PAT into your app or deployment environment.

{
  "organizations": [
    {
      "id": "org_...",
      "name": "My Organization",
      "role": null
    }
  ]
}

What a key is allowed to do

Any key can use the whole JustDeploy API for its organization. That includes the keys your AI issues for a deployed app: they read and write database rows, move files, send email, change project settings, start builds, and issue further keys. Treat an app key exactly as carefully as one you made yourself.

Databases, file storage, and verified sending domains belong to the organization, so every project shares them and there is nothing to connect per project. A key issued for one app still reaches all of them.

A project can be restricted to managing members, a console setting on the project’s page. It governs people: a signed-in user or an MCP token can create a build, rebuild, or redeploy only if that user is on the list, and roles carry no weight, so an owner who is not listed is refused too. The refusal is a 403 naming the managers, and retrying cannot help. API keys are not what the setting holds back, so keep the setting as the answer to "who on my team may deploy", not as a way to stop a key.

Issuing a key for your app

A deployed app no longer needs one of these: the SDK authenticates itself. Issue one when you are running code outside JustDeploy that has to reach the same organization. Check what the project already has first and reuse it rather than issuing another.

{
  "credential": {
    "id": 12,
    "access": "ak_...",
    "secret": "sk_...",
    "description": "App key for project prj_...",
    "expiredAt": null,
    "createdAt": "2026-07-27T00:00:00.000Z"
  }
}