Agentic Fabriq
Fly.io
DEVELOPER · DEVELOPER
Apps, machines, volumes, and Postgres clusters under their own token.
Connecting Fly.io in practice
Fly tokens default to a twenty-year lifetime unless you pass --expiry, and the Machines API is rate limited at 1 request per second per action with a burst of 3, so any agent that walks a fleet machine by machine is throttled by design rather than by volume.
Scopes that draw scrutiny
Org-scoped tokenGrants access to manage every application in an organization — the middle ground between an app token and a full auth token, and the one most CI setups reach for.Read-only org tokenRestricted to "reading a single org and its resources", which is the right grant for an agent that only inspects state.App-scoped deploy tokenLimited to one app and its resources. Fly names this the token to share with third parties, and it is what "flyctl deploy token" creates.Machine-exec tokenNarrows access to running specific commands on an app’s Machines, which is as close to per-action scoping as Fly gets.SSH tokenRestricts a credential to SSH connections on specific apps, so shell access can be granted without deploy rights.
Rate limits
- Machines API: 1 request per second per action, with a short-term burst up to 3 requests per second per action.
- Get Machine: 5 requests per second, burst up to 10.
- App deletion: 100 per minute.
- Limits are scoped per action and per identifier — Machine ID or App ID — so parallelism across machines helps and parallelism against one machine does not.
Worth knowing
- Default token validity is 20 years. Fly’s own advice is to pass --expiry with "the shortest possible duration for your use case", which means an unqualified token minted for a quick test outlives the project.
- Tokens are macaroons, so scope is attenuated at creation rather than checked against a scope list at call time — a token cannot be widened later, but it also cannot be inspected the way an OAuth scope string can.
- The Machines API answers on two hosts: https://api.machines.dev from outside and http://_api.internal:4280 from inside a Fly org’s private network, and only the second skips egress.
- fly.io/docs now 301-redirects to docs.fly.io, so older documentation links in an integration’s own runbooks break silently.
Checked against Access tokens (2026-09-29), Working with the Machines API (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Fly.io behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.