KeyKeeperFly.io
How an agent gets a Fly.io key through KeyKeeper, what to choose on fly.io, and how KeyKeeper verifies it.
| Template id | flyio (also fly) |
|---|---|
| Field | fly-api-token → FLY_API_TOKEN · secret |
| Also | fly-app-name → FLY_APP_NAME · plain, confirmed by you, optional |
| Key looks like | starts with FlyV1 , shown once when created |
| Created at | fly.io |
| Verified by KeyKeeper | not verified |
| Template checked | 2026-09-15 |
What the agent does
keykeeper providers show flyio
keykeeper save --provider flyio --from-clipboard --create --purpose "what this task does"
keykeeper run -c flyio -- <your command>--provider flyio fills in the credential id and the fields. The environment
variables are the ones Fly.io's own tools read, so nothing has to be mapped.
What only you can do
Sign in to Fly.io
Use flyctl to create a token
Choose the app, organization and expiration
Copy the key, then approve the save in KeyKeeper's window.
What to choose
Prefer fly tokens create deploy -a APP for an app-scoped deploy token. Use an org token only when the task spans apps; do not use the short-lived all-powerful login token.
The agent is told the same thing. It opens the page for you and says what to pick; it never logs in, passes 2FA or pays on your behalf.
What KeyKeeper checks
- Before writing: the value must look like a Fly.io key (starts with
FlyV1, shown once when created). A wrong paste is refused before anything is stored, and the agent is told why — without the value. - After saving: Fly.io offers no read-only endpoint KeyKeeper can use, so the first real call is the test.
Rotation and expiry
No universal expiry policy was confirmed for this credential type. Record the date shown by the provider, or leave it unknown. Rotate or revoke at fly.io.