Providers / Fly.io

Hosting

Fly.io API keys and credentials

What every Fly.io credential a founder holds does, whether it expires, and what tends to break. Each fact links to Fly.io's own docs.

Last checked 2026-11-07 · fly.io

At a glance

Each credential

Fly.io dashboard login

• Not documented

Account login for the web dashboard. Session and password policy not documented on the pages reviewed. Account owners control organization membership.

Fly.io docs

Personal auth token (created by fly auth login)

• Not documented
• Full access only

Created automatically on fly auth login. Docs call it a 'very short-lived token' and 'all-powerful' (unscoped across all orgs in the account). Exact lifetime not documented. Not meant as a long-lived CI credential.

Fly.io docs

App-scoped deploy token (fly tokens create deploy)

• You choose, default 20 years
• Can be scoped

Set with --expiry; default 175200h (20 years). Docs recommend the shortest duration that fits. Limited to one app and its resources, plus some org-wide features such as WireGuard tunnel management. Revoke with fly tokens revoke.

Fly.io docs

Org-scoped deploy token (fly tokens create org)

• You choose, default 20 years
• Can be scoped

Set with --expiry; default 175200h (20 years). Limited to a single organization and its resources, including apps. Maximum allowed expiry not documented.

Fly.io docs

Org-scoped read-only token (fly tokens create readonly)

• You choose
• Can be scoped

Read-only access to a single org and its resources. Created with --expiry; default lifetime not confirmed on the pages reviewed beyond the general 20-year default cited for other token types.

Fly.io docs

App-scoped SSH and machine-exec tokens

• You choose
• Can be scoped

fly tokens create ssh limits SSH access to one app. fly tokens create machine-exec can restrict commands via --command or --command-prefix; with no command, all commands are allowed. Expiry defaults not stated.

Fly.io docs

What usually goes wrong

• Org or app deploy token is copied into CI and forgotten; the 20-year default means it effectively never expires unless the founder sets --expiry
• Monthly card charge fails and the organization's Machines or apps are suspended
• Token is revoked or lost after a team member leaves, breaking CI deploys

Renewals and billing

Billed monthly per organization for usage (per-second Machine runtime, storage, volumes). Requires a credit card on file or prepaid credits. Past invoices are downloadable from the dashboard Billing section; no billing API is documented on the pages reviewed.

What Fly.io's docs don't say

We couldn't confirm these from official docs, so don't rely on them either way:

• Whether fly tokens list or the dashboard shows expiry dates
• Maximum allowed --expiry for deploy, org and read-only tokens
• Default lifetime for read-only org tokens and personal auth token
• Dashboard account login session lifetime and enforced password or 2FA policy
• Whether any billing or usage data is available through the API

Rotating or replacing a Fly.io key

The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:

Sources

• docs.fly.io/security/tokens
• docs.fly.io/flyctl/tokens-create-deploy
• docs.fly.io/flyctl/tokens-create-org
• docs.fly.io/flyctl/tokens-list
• fly.io/docs/about/billing
• docs.machines.dev/openapi.json
• fly.io/docs/apps/secrets/
• community.fly.io/t/secrets-not-listed-or-audit-logged-in-web-dashboard/26026

Related providers

Keep track of every Fly.io key

StackHangar stores your Fly.io keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.