Skip to main content
Korve manifests reconcile projects and their runtime, Git source, environment variables, named environments, domains, storage, queues, crons, databases, caches, realtime channels, AI gateways, App Auth policy, preview database-branch policy, alerts, app access, and project maintenance. The same versioned contract drives CLI, API, dashboard, and MCP.
The exact supported region and SKU values come from korve regions and the live API contract. Scale-to-zero projects must not declare a compute region. production and preview are implicit, so named environments must use other slugs.
Format follows the .toml, .json, .yaml, or .yml extension. Plans classify actions as create, update, no-op, deferred, invalid, or orphaned. Apply creates and updates declared resources but does not delete live resources omitted from the file. Omitting auth, access, or maintenance leaves that live policy unmanaged. Payment credentials, App Auth provider secrets, AI gateway keys, and object data never belong in a manifest. A protected access policy cannot apply until the access gateway reports enforcement ready. The current maintenance contract accepts only reliability, and its only remediation operation is deploys.create. Dangerous and destructive actions remain human-gated. Exports replace secret values and encrypted destinations with ********. Applying that placeholder preserves the live value. Never replace it with plaintext in version control. See the Manifest API.