Skip to main content
An deploys and serves traffic without any API key. This path is for images you build yourself, in CI or on your machine, and push to a registry. Unkey pulls the image and runs it. There’s no build step, no repository connection, and no GitHub App. Choose it when you already have a build pipeline, when your source isn’t on GitHub, or when you want to decide exactly when a version ships. The image must be pullable without credentials, and your container must listen on the port in the PORT environment variable, which Unkey sets to the configured port (8080 unless you change it). Reference the image with a tag (ghcr.io/acme/api:v1.2.3) or a digest (ghcr.io/acme/api@sha256:...). A reference with neither pulls latest at deploy time, so which version a got depends on when you ran it.
You need a Compute plan before you can deploy. If you don’t have one yet, the dashboard asks you to pick one the first time you try (the dialog is titled Choose a Compute plan). Only a workspace admin can do that. See Compute plans for what each plan includes.
1

Create a project

Open Projects in the dashboard and choose Create project. An app always lives in a . When the project exists, the dashboard opens the new-app flow. To add an app to a project later, open the project and choose Create app.
2

Deploy from the dashboard

On Deploy a new app, pick Container image. Enter the Image reference and choose Continue. This creates the app, named after the last part of the image path.
Run a container image card with ghcr.io/acme/storefront-worker:v1.4.2 in the Image field and a Continue button
Build and scaling settings you save on Set up your app apply to both environments.
Set up your app card with the app name, and Build, Scaling, and Environment variables blocks, each with an Edit button, above Back and Deploy
Choose Deploy. The dashboard creates the app’s first deployment in the preview and opens it, so you can check the image before anything reaches production. Leaving before you deploy asks you to discard the app.An image app has no build step, and its source kind is fixed: you can’t later connect a repository to it. Its App settings > Build page shows the image. To ship a new version or reach production, open the app’s Deployments page and choose Create deployment. Pick the Environment and enter the Image Reference, or pick an image you deployed before.
3

Deploy with unkey api deployments create-deployment

The unkey api commands match the public API one to one. create-deployment returns immediately with the deployment ID, and get-deployment reads its status. Both take the root key from --root-key or UNKEY_ROOT_KEY and print JSON with --output json.
Pass at most one of --oci, --git, or --deployment. Omit all three and the app deploys its configured default: its default image for an image app, its default branch for a Git app. A tag such as :latest is pinned to the exact image it points to when you deploy, so the deployment doesn’t change when the tag moves. The root key needs environment.*.create_deployment to create and unkey:v1:<workspace_id>:projects/*/apps/*/environments/*/deployments/*#read to read. See Root keys.
4

Wait for ready

An image deployment runs the same steps as a Git one: pending, starting, building, deploying, network, and finalizing before ready. The building step doesn’t build anything, so it’s short. The deployment still waits its turn if another deployment in the workspace is running. A production deployment that reaches ready becomes the live one and takes over the production domains, unless the app is rolled back. A preview deployment gets its own domains. If the status is failed, the error.code says why. Deployments lists the codes.

​
Next steps

Production and preview

Promote a deployment, roll back, and redeploy.

Deploy from GitHub

Let Unkey build and deploy on every push instead.

Instances and autoscaling

What the runtime defaults mean. Change them on Runtime settings.

Environment variables

Give the image its configuration and secrets.

Add API key authentication later

When you want the gateway in front of this app to check API keys before requests reach it, create a keyspace and keys in API Management, then attach a key-auth policy to the environment. Nothing in this guide depends on it.
Last modified on October 22, 2026