Verify a deployment

After deployment finishes, open the app and check the actions you use regularly. You can ask your AI agent to check that pages and APIs respond correctly.

What to check yourself

Can you open the app with your account?
Do the main actions, such as listing items and searching, work?
If the app saves data, can you save and read back test data?

Before sharing the app, also check that the intended users have access. Being able to open it yourself does not mean others can. See App URLs and domains.

For an app that only runs scheduled jobs, check the execution results in the console’s Scheduled Jobs tab.

Ask your AI agent to check

Check the main pages and APIs of the deployed app. Tell me what you verified and what remains unchecked. Use test data for checks that change data.

A successful response does not prove that calculations or business rules are correct. Give the agent typical inputs and expected results so it can check those too.

How an agent checks responses

Regular app URLs require authentication, so a plain curl request without credentials cannot verify them. keelson app curl sends requests with the permissions of the account signed in to the CLI.

A preview token is a temporary credential for accessing the app as that user. app curl obtains one internally, so you do not need to handle the token value.

Check a single response with keelson app curl

Use these commands to retrieve a page or API response:

keelson app curl /                       # GET /
keelson app curl -i /api/items           # Include response headers

Creating, updating, or deleting data and uploading files change the actual app. These examples perform writes; adjust the paths and data for your app.

keelson app curl /api/items --method POST \
  --data '{"name":"example"}' \
  --header 'Content-Type: application/json'
keelson app curl /upload --form title=example --form [email protected]

The response body goes to standard output. The method, URL, and status go to standard error. With -i, headers also go to standard error, so you can save just the body to a file.
The default method is GET. Explicitly using --method POST, PUT, PATCH, or DELETE obtains a token that allows writes and lasts five minutes.
--data can only be used with write methods. Use @filename to read data from a file.
--form sets the method to POST. The CLI adds the multipart Content-Type; you cannot override it with --header.
Paths must start with /. Absolute URLs and paths starting with // are rejected. Redirects are not followed.
You can also check /__keelson/media/... and /__keelson/assets/... with GET or HEAD.
Add --app <slug> to specify the target app.

Ask the agent to check Content-Type as well as the status. For example, a SPA might return HTML instead of a missing JavaScript file. A 200 response in that case does not mean the page will work.

Use another tool or make multiple requests with keelson preview

Issue a token directly if you want to use another HTTP client, make several requests, or choose the token lifetime.

keelson preview                          # GET / HEAD only; default 30 minutes
keelson preview --ttl 5m
keelson preview --allow-writes           # Also POST / PUT / PATCH / DELETE; default 5 minutes, maximum 10
keelson preview --json                   # Token, URL, and expiry as JSON

Use the token and app_url returned by --json in your HTTP client. Send the token as a Bearer token.

curl --header 'Authorization: Bearer <token>' '<app_url>/api/items'

The token is shown once on standard output and is not stored by Keelson. Do not include it in logs or reports. Only one keelson preview token can exist per app and user. Issuing another revokes the previous token, even if it has not expired. keelson app curl uses a separate internal token and does not revoke the token issued by preview.

Apps deployed by someone else

If you did not create the currently served deployment, the CLI provides an approval URL to open in a browser before issuing a preview token. Approval requires the app’s manage permission (manage). You can approve your own request if you have that permission.

Review the app, write access, and lifetime on the approval page, then approve token issuance. Rerun the same command with the supplied --confirmation <id>.

What these checks do and do not cover

These commands retrieve responses using your permissions. Check browser appearance and interactions, and other users’ access, separately.
Static sites have no write destination, so write methods are rejected.
Even a GET request can change data or send email if the app implements it that way. Ask the agent to inspect the code first and avoid paths that would cause unintended changes.