Fly.io CLI and Least-Privilege Token Setup
Overview
Separate interactive login from automation credentials. Current Fly.io guidance provides scoped deploy, organization, read-only, SSH, Machine-exec, and WireGuard token types; choose the smallest authority and lifespan that satisfies the workflow.
Prerequisites
- Named human or workload identity and business owner
- Target organization, app, commands, environment, and expiry requirement
- Approved installation source and secret storage location
Instructions
Step 1: Select the identity mode
Use browser login for a human workstation. For automation, map required actions to app deploy, organization deploy, read-only, SSH, Machine-exec, or WireGuard scope.
Step 2: Install from an official channel
Follow the provider installation method for the operating system, then record fly version and the provider-maintained release tag. Pin CI setup where reproducibility matters.
Step 3: Create a scoped expiring token
Prefer fly tokens create deploy for one app and fly tokens create readonly for observation. Use organization scope only for justified multi-app operations.
Step 4: Store and inject once
Place the token in the approved secret manager and expose it only as FLY_API_TOKEN or FLY_ACCESS_TOKEN to the intended process.
Step 5: Validate the smallest read
Confirm effective identity and scope through a non-mutating app or Machine read. Distinguish an empty scoped listing from a failed credential.
Step 6: Plan rotation and revocation
Record token ID, owner, scope, expiry, dependents, overlap procedure, emergency revocation, and post-rotation verification.
Authentication
Machines API requests send Authorization: Bearer <token> to the public https://api.machines.dev endpoint outside the private network. The hidden deprecated fly auth token output is an all-powerful short-lived login token and must not be used as the routine CI credential.
Tool Discipline
Use Read and Grep to inspect application configuration, deployment evidence, provider documentation, fixtures, logs, schemas, and existing tests before proposing a change. Use Write or Edit only for an approved plan, configuration, implementation, test, or redacted receipt. Do not create, deploy, scale, restart, stop, suspend, destroy, rotate, revoke, expose, or migrate live Fly.io resources without explicit operator approval.
Output
- flyctl installation and version receipt
- Token inventory containing only identifier, owner, scope, expiry, and secret reference
- Read-only scope proof plus rotation and revocation runbook
Return the target organization, app, environment, region set, Machine or database identifiers, source-contract fingerprint, evidence, unresolved risks, rollback state, and final decision without exposing tokens, secrets, connection strings, or customer data.
Examples
A single-app production pipeline receives a 30-day app deploy token in its protected environment. A monitoring job receives a separate organization read-only token. Both record token IDs and owners, while values remain only in the secret manager.
Error Handling
| Failure | Response |
|---|---|
| Identity appears valid but listings are empty | Check scope filters and target app before broadening access; scoped tokens can hide out-of-scope resources. |
| Token is exposed | Revoke by token ID, rotate dependents, inspect access evidence, and avoid repeating the value in the incident record. |
| flyctl behavior differs from docs | Record the installed version, compare with the current provider release, and revalidate commands before use. |