Skip to main content

​
Overview

OneCLI connects AI agents to Fly.io so they can deploy and manage applications, Machines, volumes, and secrets. The gateway injects your API token into requests automatically.

​
Setup

1

Create an API token

Generate a token from the Fly.io dashboard or run:
2

Connect in OneCLI

Open the OneCLI dashboard, go to Connections > Fly.io, and paste your API token.

​
How it works

  1. Your API token is encrypted and stored by OneCLI
  2. When an agent sends a request to api.machines.dev or api.fly.io, the gateway intercepts it
  3. The gateway injects the token as an Authorization: Bearer header
  4. The request is forwarded to Fly.io
Agents never see the raw token.

​
What agents can do

​
Use cases

  • Coding agents deploying applications after building
  • Infrastructure agents scaling Machines up or down
  • Monitoring agents checking application health
  • Agents managing secrets and environment variables

​
Controlling access

Access is per agent: grant the connection to each agent that needs it, choosing per tool what runs freely, what needs human approval, and what stays blocked — a read-only agent is a single grant. Organization rules add guardrails on top, like rate limits and blanket blocks. Everything is checked before credential injection, so a blocked request never reaches Fly.io.