# kindgi deploy > Deploy a signed pack image to Kindgi ## `kindgi deploy` **Synopsis** ```sh signature kindgi deploy [--env ] [--from-envelope ] [--endpoint ] [--token ] [--tenant ] [--project ] [--hosted] [--idempotency-key ] [--dry-run] [--sync-secrets] [--allow-missing-env] [--target ] [--build-endpoint ] [--out ] [--artifact-version ] [--published-at ] [--signing-key ] [--signer-key-id ] [--registry-push-creds ] [--skip-integrity-gate] [--skip-image-pull] [--skip-sign] [--path ] ``` Deploy a signed pack image to Kindgi. Reads deploy-envelope.json (or runs `kindgi build` inline) + POSTs to /v1/deployments. `--hosted` (or the env block's `build: 'hosted'`) deploys to Kindgi hosted: an inline build runs on the hosted build service (as `kindgi build --hosted`), and after the deploy it waits, up to 5 minutes, for the deployment's pack service to be ready. A deploy into the Default project with a pack tool whose id is an MCP endpoint's tool's is refused (`tool-kind-mismatch`), and nothing is deployed. **Options** | Option | Default | Description | | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `--allow-missing-env` | off | Deploy, with a warning, even when a name in the pack's `env.required` has no value for `--env`. | | `--artifact-version ` | for an inline build: the build time, as `YYYYMMDD.HHMMSS` (UTC) | For an inline build: the artifact version. Default: the build time as `YYYYMMDD.HHMMSS` (UTC). For a reproducible build, pass `--artifact-version` and `--published-at`. | | `--build-endpoint ` | for an inline build: the env block's `build` | For an inline build: the build server (`kindgi build --endpoint`). Default: the env block's `build`. | | `--dry-run` | off | Print the equivalent `curl` request instead of sending it. A missing envelope is still built first. | | `--endpoint ` | the env block's `endpoint`, else the CLI's API URL (`--url`, `KINDGI_API_URL`, config files); required when none. A stored API key goes only to the address stored with it, and the key stored with the endpoint's address is the one used (`--token` or `KINDGI_API_TOKEN` gives another server's key); with `--hosted`, the endpoint can only be the CLI's API URL, and the `.kindgirc.json` that `kindgi dev` writes isn't read | The API to deploy to. Default: the env block's `endpoint`, else the CLI's API URL (`--url`, `KINDGI_API_URL`, config files). | | `--env ` | `staging` | The environment: its block in `kindgi.config.ts` and its `.env.` file. Default: `staging`. | | `--from-envelope ` | `deploy-envelope.json` in `--out`; an inline build runs when it is missing | The envelope to deploy. Default: `deploy-envelope.json` in `--out`; when there is none, `kindgi build` runs first. | | `--idempotency-key ` | a hash of the request body | The `Idempotency-Key` header. Default: a hash of the request body, so the same image deployed again returns the same deployment. | | `--out ` | `.kindgi/build` under the pack root | Where the envelope is looked for, and an inline build writes (default: `.kindgi/build`). An inline build applies the same --out rules as `kindgi build`: not the pack root or a directory containing it, and under it for a TypeScript pack. | | `--path ` | the current directory | The pack root. Default: the current directory. | | `--project ` | none: a tenant-wide deploy, into the tenant's Default project | The project to deploy into, one per client: its id, or its slug. A slug two orgs share is refused: pass the id. Default: a tenant-wide deploy, into the tenant's Default project. | | `--published-at ` | for an inline build: the build time | For an inline build: the publish time (an ISO 8601 time with a zone, or a date: its start, UTC). Default: the build time. For a reproducible build, pass `--artifact-version` and `--published-at`. | | `--registry-push-creds ` | none | For an inline build: a reference to the registry push credentials for the build server to use. | | `--signer-key-id ` | for an inline build: the env block's `signerKeyId`, else the key file's name | For an inline build: the key id the signature names. Default: the env block's `signerKeyId`, else the key file's name. | | `--signing-key ` | for an inline build: the env block's `signingKey` | For an inline build: the Ed25519 private key (PEM) to sign with. Default: the env block's `signingKey`. | | `--skip-image-pull` | off | For an inline build: check the image's index by hash only, without pulling the image. | | `--skip-integrity-gate` | off | For an inline build: sign without checking the image's index against the local one. | | `--skip-sign` | off | For an inline build: write an unsigned envelope, which the deploy then refuses unless `--dry-run`. | | `--sync-secrets` | off | After the deploy lands, also send the values in `.env.` to the deployment's secrets. Off by default. A hosted deploy needs --env with it. | | `--target ` | for an inline build: the env block's `buildTarget`, else the env name | For an inline build: the build target. Default: the env block's `buildTarget`, else the env name. | | `--tenant ` | none (no check); an inline build takes the env block's `tenantId`, else `KINDGI_TENANT_ID` | Refuse unless the envelope was signed for this tenant (checked before sending). Also passed to an inline build. | Every command also takes the [global flags](https://docs.kindgi.com/v0.1.9/reference/cli.md#global-flags). **Examples** From [Deploy on Azure Container Apps](https://docs.kindgi.com/v0.1.9/deploy/self-hosted/azure-container-apps.md): ```sh pnpm exec kindgi deploy --env dev --endpoint "$URL" ``` From [Deploy on Google Cloud Run](https://docs.kindgi.com/v0.1.9/deploy/self-hosted/cloud-run.md): ```sh pnpm exec kindgi deploy --env prod --endpoint "$URL" ``` **See also** - [Deploy on Azure Container Apps](https://docs.kindgi.com/v0.1.9/deploy/self-hosted/azure-container-apps.md) - [Deploy on Google Cloud Run](https://docs.kindgi.com/v0.1.9/deploy/self-hosted/cloud-run.md) - [Rotate the runtime's tokens and keys](https://docs.kindgi.com/v0.1.9/deploy/self-hosted/rotate-keys.md) - [Self-host Kindgi](https://docs.kindgi.com/v0.1.9/deploy/self-hosted/self-host.md)