Authentication and publishing

Public package installation does not grant deployment access. Set the HTTPS platform origin and request approval for the intended channel:

export SHOPLIFTER_API_URL=https://YOUR-PLATFORM-API-HOST
shoplifter login YOUR-CHANNEL-CODE
shoplifter files
shoplifter publication upload YOUR-CHANNEL-CODE
# Use upload's source id, then stage's candidate id, then preview's build id:
shoplifter publication stage YOUR-CHANNEL-CODE SOURCE-ID
shoplifter publication preview YOUR-CHANNEL-CODE CANDIDATE-ID
shoplifter publication status YOUR-CHANNEL-CODE BUILD-ID
shoplifter publication logs YOUR-CHANNEL-CODE BUILD-ID

Replace each ID with the response from the preceding operation. Login opens dashboard approval; omit the channel to choose one there. Set SHOPLIFTER_NO_BROWSER=1 to print the approval link. Credentials last one hour and live outside source under the CLI configuration directory. shoplifter logout revokes the current credential.

The CLI calls the positional ID revision, but each action expects a different kind:

Actions	ID to supply
stage	Source ID from upload
preview, build, publish	Candidate ID from stage
status, logs, retry, retry-deployment, activate, rollback	Build ID from preview/build/status

Staging imports bundled default assets into the channel and creates a candidate; it does not activate a live site. CLI preview uses the candidate’s staged published content context. Dashboard draft content preview is a separate workflow.

Review before going live

Publication actions include upload, stage, preview, preview-link, build, publish, status, logs, retry, retry-deployment, activate and rollback. Inspect the returned state before choosing the next action; these are not a script to execute blindly.

stage, preview, build, retry, retry-deployment, activate and rollback require an ID. A language may follow it. For review-only work, stop after a successful preview and protected preview review.

build requests a production-mode build and can automatically activate when the source already matches the live source. publish promotes draft content and requests a production build, which can also activate automatically. activate explicitly activates a successful production build after exact-input preview checks. Treat all three as potentially live-changing actions requiring authorization; build is not a harmless preview command.

shoplifter publication preview-link YOUR-CHANNEL-CODE requests protected preview access. Add --reset only to revoke existing preview browsers. Do not share protected links publicly.

Interruptions and recovery

Repeat the same upload command after a transfer interruption or renewed login. Matching input resumes; changed inputs start a new upload. Keep tokens and signed URLs outside project files.

Inspect revision status and logs before retrying. Source corrections need a new upload. Rollback uses a known retained revision and changes live state; confirm the intended target and authorization. Verify the final deployment status.