Integrate into CI/CD

Set BEAM_TOKEN through your CI provider’s secret store. The CLI reads it directly; you do not need an interactive browser login or a command that prints or writes the token.

python -m pip install beam-client
beam --no-input deploy app.py:handler

Install any packages imported by the deployment module in the CI environment too. Runtime packages declared in Image are installed remotely and do not make local imports available.

GitHub Actions

Save a workspace token as the repository or environment secret BEAM_TOKEN. This example deploys the same handler to distinct app names on main and staging.

app.py

import os
from beam import endpoint


@endpoint(name=f"app-{os.environ.get('BEAM_DEPLOY_ENV', 'staging')}")
def handler():
    return {"ok": True}

Create .github/workflows/beam.yml:

name: Deploy to Beam
on:
  push:
    branches: [main, staging]
permissions:
  contents: read
concurrency:
  group: beam-${{ github.ref }}
  cancel-in-progress: false
jobs:
  deploy:
    runs-on: ubuntu-latest
    env:
      BEAM_TOKEN: ${{ secrets.BEAM_TOKEN }}
      BEAM_DEPLOY_ENV: ${{ github.ref_name == 'main' && 'prod' || 'staging' }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-python@v7
        with:
          python-version: '3.11'
      - name: Install deployment dependencies
        run: python -m pip install beam-client
      - name: Deploy
        run: beam --no-input deploy app.py:handler

The workflow uses the current examples from actions/checkout and actions/setup-python. Pin the Beam client and application dependencies in your project’s lockfile for reproducible deployments. For a Dockerfile project, replace the deploy command with beam --no-input deploy --name app-prod --dockerfile Dockerfile --port 8000. Python SDK installation is still needed for the CLI, but your container’s application dependencies belong in its Dockerfile.

Readiness and rollback

A successful deploy creates an active version; it does not prove that requests can be served yet. Record the deployment ID returned by the command, then run beam deployment wait <deployment-id> --timeout 300 for an endpoint or ASGI deployment. Add an application-level smoke check appropriate to your workload. See deployment lifecycle for rollout options and rollback. Keep deployment credentials scoped to the intended workspace and restrict which branches can access production CI secrets.

Start Here

Sandboxes

Inference

Building Blocks

Container Images

Data and Storage

Scaling

Operations

Run in Your Cloud

Advanced Topics

Resources

Security

Integrate into CI/CD

GitHub Actions

Readiness and rollback

​GitHub Actions

​Readiness and rollback

GitHub Actions

Readiness and rollback