Private repositories and deploy keys

Private repositories work through a deploy key: a read-only SSH key that belongs to one app and unlocks one repository. You never upload your own credentials.

Setting it up

1. In Apps → New App, choose A private Git repository.
2. Use the repository’s SSH form: git@github.com:you/repo.git (not the https:// URL).
3. After creating the app, the panel shows the app’s public key. Add it to the repository:
   • GitHub: repository → Settings → Deploy keys → Add deploy key → paste, leave write access off.
   • GitLab: Settings → Repository → Deploy keys.
   • Bitbucket: Repository settings → Access keys.
4. Back in the panel, open the app and press Deploy Now.

The key stays visible under the app’s Settings tab if you need it again.

Caution

Deployments fail with an authentication error until the key is added to the repository. If you rotate or remove the key on the Git host, the next deployment fails the same way.

One key per app

Each private app gets its own key, and deleting the app deletes its key. Nothing is shared between apps, so revoking one app’s access never breaks another.