For AI agents: the complete documentation index is at llms.txt. Remove the trailing slash from a page URL and append .md to read its Markdown version. For the docs home, use index.md.
Newxy is now in Reflex Build (opens in a new tab)
Reflex LogoDocs Logo

reflex-hosting-cli Changelog

v0.2.0 (2026-10-08)

Breaking Changes

  • Some reflex cloud commands changed what they report: (#7207)
    • A refused request exits non-zero instead of printing a "... failed: ..." line and exiting 0, and --json writes no document. This includes vmtypes and regions, which answered a failed request with an empty listing, and apps stop, apps start and apps delete, which now report their own outcome rather than echoing the server's message.
    • apps history --json replaces hostname with the deployment's url, reports vm type as the machine's name rather than an object, and reports timestamp as an ISO 8601 string with an offset. apps inspect --json drops hostname from latest_deployment.
    • create-token --json replaces expires_in_days with expires_at, an ISO 8601 string or null, carrying the expiry the server applied.
    • apps logs drops its unused --cursor option, and its --json document returns every line in the window rather than one page.
    • apps status --watch --json reports "success": null when the watch stopped before the deployment finished.
    • project role-permissions lists permission names rather than objects.
    • reflex deploy requires a control plane that signs upload URLs; the multipart upload fallback for older ones, and its "payload is too large (over 100MB)" hint, are gone.
  • Require Python 3.11 or newer; Python 3.10 is no longer supported. (#7449)

Bug Fixes

  • reflex cloud reports a refusal as the sentence the API wrote rather than a message of its own, and an expired token now says to run reflex login wherever it turns up — not only where a command started by authenticating. (#7207)
  • reflex cloud apps delete now exits non-zero when the app ID is not found. (#7295)
  • With --no-interactive, a rejected access token now fails right away with the same message reflex cloud whoami gives, instead of starting the browser login. (#7298)
  • Preserve a different stored access token when authentication rejects an outdated or explicitly supplied token. (#7321)
  • reflex deploy now consistently shows the "Built with Reflex" badge on apps deployed on the free tier, including apps built with earlier reflex releases. Paid plans can still hide it with show_built_with_reflex=False. (#7333)
  • reflex cloud apps list, apps history and apps inspect keep app names and app and deployment IDs whole on one line, so you can copy them from a normal-width terminal. apps list and apps history show fewer columns; --json still returns every field. apps inspect shows one field per row. Tables no longer draw cell borders. (#7351)
  • reflex cloud secrets update now prints a success line naming the keys it set and whether the app is rebooting, like secrets delete already did. Only key names are printed; values are never logged. (#7352)
  • Fail reflex deploy before building when an explicitly requested project does not exist or does not own the selected app. Accept equivalent UUID spellings, including uppercase and unhyphenated project IDs. (#7355)

Miscellaneous

  • reflex-hosting-cli now talks to Reflex Build through reflex-build-sdk, so every command shares the SDK's retries, timeouts and typed errors. While the SDK is pre-1.0, the CLI pins it to a single patch line, so upgrade reflex-hosting-cli to move to a newer SDK rather than upgrading the SDK on its own. (#7207)

v0.1.72 (2026-09-11)

Breaking Changes

  • Two reflex cloud defaults changed. --interactive now defaults to whether stdout is a terminal rather than to on, so a pipe, a CI job or an agent is refused with an error instead of waiting at a prompt that nobody answers -- reflex cloud apps list in CI with no token now exits 1 with "Token is required for non-interactive mode." Pass --interactive to restore the old behavior. And reflex cloud apps logs --follow now defaults to off, since following prompts between pages and so never returns on its own; pass --follow true for the old behavior. reflex deploy takes the same terminal-derived --interactive; it keeps --json for log records only, since its progress is a stream rather than a result. (#6917)

Features

  • Every reflex cloud command now takes --json, writing one JSON document to stdout while human-readable messages move to stderr, so the output is parseable without reading a Rich table. Note that a message only lands on stderr if the installed reflex-base carries the reservation: against an older one, --loglevel debug still writes its records to stdout and they precede the document. (#6917)

Bug Fixes

  • Fix version comparison bug that broke compatibility with reflex-0.7.6.post1 (#6963)

v0.1.71 (2026-08-28)

Breaking Changes

  • REFLEX_ACCESS_TOKEN now takes precedence over the token stored by reflex login. Previously the stored token won and the environment variable was consulted only when no token was stored, so exporting it to run a script against a different account had no effect on a machine that had ever logged in — silently, and with no way to tell which credential was in use. Exporting the variable is an explicit choice for that invocation; the config file is ambient state left behind by an earlier login. This changes behavior only when both are present and differ. reflex cloud whoami reports which source is in use. (#6918)

Features

  • Added reflex cloud whoami and reflex cloud token. whoami reports the account, org, tier and token source that the CLI is authenticating as, resolving the token against the control plane without ever starting a browser login and without printing the token — it shows a non-reversible fingerprint instead, so two machines can be compared without anyone sharing a secret. reflex cloud token takes exactly one of --print, --set TOKEN or --clear: --print writes the raw token to stdout for capture (export REFLEX_ACCESS_TOKEN=$(reflex cloud token --print)), --set validates the token with the control plane before storing it and leaves the previous one in place if it is rejected, and --clear removes the stored token, noting when REFLEX_ACCESS_TOKEN remains set and will take over. (#6918)
  • On the deploy that first lands an app on GCP, --hostname now doubles as the app's Cloud Run service name, so the service in the customer's console reads like the app's URL instead of app-<uuid>. A hostname the service-name grammar refuses (leading digit, over 49 characters, or the reserved app-<uuid> shape) is skipped with a note and the server generates a name from the app name; later GCP deploys never send one, since the name is pinned to the live service. (#6937)
  • reflex deploy uploads a build's two archives straight to storage, concurrently and with a progress bar for each, instead of relaying them through the control plane. (#6938)
  • reflex cloud deploy now reports why a deploy failed instead of exiting on a status string: the recorded reason, whether the failure was in your app or on Reflex's side, and the end of the build log when that is what explains it. (#6948)

Bug Fixes

  • The hosting config file (hosting_v1.json) is now written atomically. save_token_to_config and delete_token_from_config opened it with mode "w", truncating it before writing, so a failed write — a full disk, an I/O error, an interrupted process — left an empty file and destroyed the stored access token and selected project. Neither helper reports write failures to the caller (save_token_to_config logs a warning, delete_token_from_config only a debug message), so this was easy to miss. Both now serialize to a temporary file alongside the target and move it into place, leaving the existing credentials untouched when a write fails. A config that exists but cannot be read is no longer treated as empty either, so delete_token_from_config leaves a malformed file alone instead of replacing it; save_token_to_config still starts fresh from one, so a corrupt config cannot block re-authenticating. This also covers reflex login and reflex logout, which share these helpers. (#6918)
  • Fix for older reflex versions

Miscellaneous

  • The hosting CLI's logging goes through standard python logging. On reflex 0.9 and up it shares the reflex-base console and LogLevel; on earlier reflex, where reflex-base is not installed, the CLI renders the same output itself. Debug output renders purple (was blue), errors go to stderr (was stdout), and success messages are hidden at --loglevel warning. (#6866)
  • reflex cloud token --set accepts the token on stdin — pass -, or omit the value entirely — so live credentials need not appear in shell history or the process list. When stdin is a terminal it prompts without echoing. reflex cloud whoami writes its output directly rather than through the shared console, which applies rich markup and wraps to the terminal width: identifiers now print in full instead of being truncated to fit, and --json stays on one line so it can be piped. (#6918)
  • The reflex deploy command implementation now lives here, in reflex_cli.v2.deploy. The package no longer imports the reflex framework at module scope, so it stays importable on its own. (#6924)

v0.1.70 (2026-08-18)

Deprecations

  • reflex cloud deploy is renamed to reflex cloud gcp-standalone, deprecated as of 0.1.70 and removed in 0.2.0. Inside the reflex cloud group, deploy meant the standalone gcloud script runner while reflex deploy meant the managed platform deploy — one namespace apart, opposite semantics. The old name still works and is hidden from help; invoking it warns, naming both the new name and the managed path. (#6908)

Features

  • deploy() accepts gcp_connection, full_deploy and strategy. gcp_connection resolves a named GCP connection and pins the app to it (provider_account_id on the provider write), instead of every CLI deploy landing on the organization's default connection. full_deploy is written before the hostname is reserved, so the reserve hands back the single provider origin the frontend is then compiled against. All three can also be set in the config file. (#6908)
  • reflex cloud providers list (also reachable as providers connections) now lists each connection's name, default marker and runtime service account, so there is something to pass to reflex deploy --gcp-connection. providers status lists the same connections. A member who may not read the organization's stored provider accounts still gets the connection names, from the GCP status; their runtime identities are reported as unreadable rather than as the project default. (#6908)

Bug Fixes

  • Optional settings in cloud.yml / pyproject.toml are validated again on Python 3.10–3.13. A X | None annotation reports as types.UnionType there, which the config validator did not recognize, so every optional field went unchecked on those versions while being checked on 3.14 — a quoted full_deploy: "false" was sent to the server as a truthy string, and a non-string hostname or gcp_connection failed later with a TypeError instead of a config error. (#6908)

v0.1.69 (2026-08-13)

Features

  • deploy() accepts min_instances and max_instances, which are applied to the app before the deployment is submitted so it picks the new autoscaling bounds up. Only the bounds explicitly passed are sent, so apps keep their platform defaults otherwise. (#6884)

Bug Fixes

  • --vmtype is no longer dropped when deploying to Google Cloud. The server maps VM types onto Cloud Run CPU/memory limits, so the flag is now passed through; only --region is still ignored for that target, since the region comes from the connected GCP account. (#6884)

v0.1.68 (2026-08-03)

Features

  • When a deployment requires approval, reflex deploy now reports that the build was submitted for approval and will deploy automatically once approved, instead of polling indefinitely. (#6797)
  • Token validation requests now send an X-Request-ID header, and failed validations print the ID (e.g. Unable to validate access token: ... (auth request id: ...)) so it can be quoted to support to correlate the failure with server-side logs. (#6821)
  • Added Google Cloud (GCP) as a managed deploy target for reflex deploy. When your organization has a GCP account connected (Enterprise tier), reflex deploy asks whether to deploy to Reflex Cloud or your GCP account (or pass --provider gcp / set provider: gcp in your config to skip the prompt), and reflex cloud providers status / list report the connection state.
  • Added reflex cloud apps rollback DEPLOYMENT_ID, which rolls an app back to a previous deployment by redeploying its already-built image without rebuilding from source. reflex cloud apps history now reports whether each deployment can be rolled back to.
  • Added optional per-deployment descriptions (changelog notes): set one at deploy time with reflex deploy --description "...", set or clear it later with reflex cloud apps describe, and view it in reflex cloud apps history.

Miscellaneous

  • Raised the rich upper bound to <16 (adopting rich 15). (#6678)

v0.1.67 (2026-06-17)

Features

  • Added a --service-account flag to reflex deploy --gcp, letting Cloud Run services run as a least-privilege per-service service account instead of the project's default compute SA. (#6556)
  • Added --max-instances, --allow-unauthenticated/--no-allow-unauthenticated, --env KEY=VALUE, and --envfile flags to reflex deploy --gcp, letting you cap Cloud Run autoscaling, deploy a private service, and set environment variables at deploy time. (#6557)
  • Added reflex cloud scan, which uploads your app source for a Reflex-aware security review and reports security and logic flaws. Supports --json output and a --fail-on severity gate for CI. (#6632)