Render

Why an API key instead of OAuth#

Unlike Vercel, Render offers no third-party OAuth flow — there is no “Authorize deplo.ai” button to build on. The supported way for a tool to act on your behalf is a Personal API key created in your Render dashboard. deplo.ai treats that key with the same care as an OAuth token: validated before storage, encrypted at rest, and never shown again.

Connecting#

1. Create an API key on Render

   Open dashboard.render.com → Account Settings → API Keys and click Create API Key. Keys start with rnd_. Copy it now — Render only shows it once.

2. Paste it into deplo.ai

   Go to Dashboard → Integrations, open the Render card's guided connect panel, and paste the key. From the terminal, the same flow is:

   terminalcopy

   $ deplo connect render
   # prompts for the key, or pass it directly:
   $ deplo connect render --key rnd_xxxxxxxxxxxx

3. Live validation before storage

   The key is checked for the rnd_ format, then validated with a live call to Render's GET /v1/owners endpoint. A key Render rejects — or one with no accessible workspaces — is refused and never persisted. On success, deplo.ai records your workspace (preferring your personal workspace over teams), encrypts the key with AES-256-GCM, and stores it in your per-user provider connection.

What deplo.ai does with the key#

The key is used only by the deployment pipeline and monitoring, always inside your own workspace:

• Creates or reuses web services — a redeploy finds the existing service by name instead of creating a duplicate, and monorepo backends get the correct root directory.
• Sets environment variables on the service — your values plus wiring like FRONTEND_URL for CORS.
• Triggers deploys and polls their status until the service is live (or fails, with logs).
• Reads CPU and memory metrics for the service to power per-project monitoring.

Services created by deplo.ai default to Render's free plan — you can upgrade any service from your own Render dashboard at any time, and deplo.ai will keep deploying to it. Like Vercel projects, these are ordinary services in your workspace: logs, scaling, custom domains, and billing all stay under your control on Render's side.

Key rotation#

Rotation is just reconnecting: create a new key on Render, then connect again from the dashboard's Render card (Rotate) or with deplo connect render --key rnd_<new>. The new key goes through the same live validation and replaces the old one in place. Delete the old key on Render afterwards.

Security posture#

• Validated against the live Render API before anything is stored — invalid keys never touch the database.
• Encrypted at rest with AES-256-GCM in the per-user provider connection table.
• Never logged, and never echoed back by any API — GET /api/v1/integrations returns status and workspace name only.
• Shown in the dashboard forever after as a masked rnd_••••.
• Deployments run exclusively in your workspace — there are no platform-owned Render credentials.

Disconnecting#

Disconnect from Dashboard → Integrations (with a confirmation step), which calls:

DELETE /api/v1/integrations/render
Authorization: Bearer <token>

{ "disconnected": true }

After disconnecting:

• New backend deployments fail fast with “Render account not connected” until you reconnect.
• Existing services keep running in your workspace, untouched.
• The connection is marked disconnected on deplo.ai's side — to revoke the key itself, delete it in Render → Account Settings → API Keys.