Webhook reporting
Repository and provider credentials are not required.
For normal webhook reporting, DeployState does not require access to your repository or Forge, Ploi, GitHub, or other deployment-provider credentials. Your deployment system sends an HTTPS request when a step starts, completes, or fails.
Private endpoints
Every step has its own private webhook URL.
Each deployment step receives a unique private URL. Keep that URL in the deployment tool’s secret store and do not include it in source control, screenshots, or support requests.
Credential recovery
Regenerate a compromised webhook URL.
Workspace members can rotate a step’s private key from the sequence editor. Rotation invalidates the existing webhook URL, so update the deployment tool immediately afterward.
Desktop access
Desktop pairing uses a code shown once.
When you authorize the desktop app, DeployState creates a personal access token and shows the pairing code once. You can revoke personal tokens from Settings; keep the desktop pairing code private as well.