LeashLeash

Local dev

The one canonical local-dev flow for Leash apps. Same code, same SDK, same identity as production — just running on your laptop.

The four steps

  1. 1. Install the SDK

    Terminal

    $ npm install @leash/sdk

    TypeScript only today. Tier 1 hosting-only apps don't need the SDK at all — if you're reading injected env vars with your language's standard env-var API, skip to step 3.

  2. 2. Mint an org API key

    Visit /dashboard/organization → API Keys → create one. Save the value to .env.local:

    .env.local
    LEASH_API_KEY=lsk_live_...

    In production this is auto-injected by leash deploy. You only need it locally. See org API key.

  3. 3. Start your dev server

    Terminal

    $ npm run dev # or python app.py / go run . / etc.

    Your usual command. Integrations and leash.env.get() (TypeScript SDK) work the same as in production — every SDK call goes through leash.build.

    Prefer to also inject your org's secret-source values into your dev process's environment at startup? Use leash dev — it wraps whatever dev command your stack uses (Node, Python, Go, Ruby, Rust).

  4. 4. (Optional) Sign in with your Leash identity locally

    Only needed if your code calls leash.auth.user(). The leash-auth cookie's scope is .leash.build — it isn't sent to localhost by default. Mount the dev-auth handler once per project:

    app/api/leash/dev-auth/route.ts
    import { Leash } from '@leash/sdk/leash'
    

    export const GET = Leash.createDevAuthHandler()

    Then open your app at https://leash.build/dashboard/apps/<id> and click “Open in local dev”. The handler swaps the one-time code for an 8-hour HttpOnly cookie on localhost. From that point on, leash.auth.user() returns the same identity you have on *.un.leash.build.

What changes between local and deployed

LocalDeployed
LEASH_API_KEYIn your .env.localAuto-injected
leash-auth cookieSet on localhost via the dev-auth handler (step 4)Auto-sent on every request to *.un.leash.build
leash.env.get()Fetches at runtime same as prodSame

Same code runs on both sides.

No offline / mock mode

Every SDK call goes through leash.build, so a Leash account is required regardless of where you run. Free-tier covers most local dev.

Related

  • leash dev — inject org secret-source values into your local dev process's environment (Node, Python, Go, Ruby, Rust).
  • User identity — reference for leash.auth.user() and the dev-auth handler.
  • App env vars — the .env.example manifest and the org-level source model.