GitHub: Create a deploy key

← Repos operations · Get started

Operation github.repos_create_deploy_key

Provider route: POST /repos/{owner}/{repo}/keys. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["repos"]["reposCreateDeployKey"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.repos.reposCreateDeployKey(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.repos.repos_create_deploy_key(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
path	object	Required within parent	Additional keys: not allowed
path.owner	string	Required within parent
path.repo	string	Required within parent
body	object	Required within parent
body.key	string	Required within parent	The contents of the key.
body.read_only	boolean	Optional	If `true`, the key will only be able to read repository contents. Otherwise, the key will be able to read and write. Deploy keys with write access can perform the same actions as an organization member with admin access, or a collaborator on a personal repository. For more information, see “[Repository permission levels for an organization](https://docs.github.com/articles/repository-permission-levels-for-an-organization/)” and “[Permission levels for a user account repository](https://docs.github.com/articles/permission-levels-for-a-user-account-repository/).”
body.title	string	Optional	A name for the key.

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	Model	Root	Expand Get a deploy key — response body

Referenced models: Get a deploy key — response body

Schemas

Get a deploy key — response body

Field	Type	Presence	Description and constraints
$	object	Root	An SSH key granting access to a single repository.
added_by	JSON	Optional
added_by (anyOf 1)	string	Alternative
added_by (anyOf 2)	null	Alternative
created_at	string	Required within parent
enabled	boolean	Optional
id	JSON	Required within parent
id (anyOf 1)	integer	Alternative
id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
key	string	Required within parent
last_used	JSON	Optional
last_used (anyOf 1)	string	Alternative	Format: date-time
last_used (anyOf 2)	null	Alternative
read_only	boolean	Required within parent
title	string	Required within parent
url	string	Required within parent
verified	boolean	Required within parent

Policy, approvals and errors

SDK function policy ID: github.repos_create_deploy_key. Catalog operation: repos/create-deploy-key. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

Official provider source