To bootstrap a deployment, run qm init via npx from an organization-owned repository; initialization walks through infrastructure, web sign-in, connector credentials, optional Slack access, deployment, and live verification without requiring a source checkout.[1] The full invocation for a new org layer takes the form node cli/bin/qm.ts init deploy/layers/<org> --org <slug> --target <fly-or-aws>, where <slug> is a local name derived from the organization and is not globally unique.[2]
qm init materializes deployment.md and .codex/skills/deploy-qm/ in the new deployment directory; the generated skill is handed to an agent to drive the rest of the deployment.[2] Base model provider defaults to anthropic (its API key is a required secret), and sign-in email transport defaults to resend; the command prompts the operator to choose one email transport and scaffolds only that transport's secret keys.[3][4]
The built-in auth broker uses email-delivered one-time links (magic links); supplying the admin address, a verified sender, and a Resend key or SMTP credentials is sufficient — the CLI generates and wires the rest.[2] To use an external identity provider instead of the built-in auth broker, drop "auth" from services; that provider must register the exact <publicUrl>/auth/callback redirect URI.[2]
Sources