Fly.io

Export secrets into a Fly app.

The connection

What	This provider
Vendor	Fly.io
Key	`fly-secrets`
Availability	`available`. You can connect it today.
Credential penv holds	`fly-token`
Values read back	no
Activation	`on-request`

Direction	What it does
`export`	Writes names and values from penv into the store.

Fly.io returns no value once it holds one, so penv can write here and cannot read back.

on-request. A new value waits there. penv can deploy to activate it, and the sync form asks you first.

Direction	Policies you can pick
`export`	`create_only`, `overwrite`, `overwrite_and_prune`

How syncs work says what each one does.

You paste a credential you already hold. penv seals it and never shows it again.

Field	Label	Kind	Required	What it is
`token`	Access token	secret, masked here and sealed	yes

Fixed when you connect, and shared by every mapping on it.

Field	Label	Kind	Required	Advanced	What it is
`orgSlug`	Organization	text	yes	no	Use an organization token (`fly tokens create org`). An app deploy token cannot list the org, so verify fails on it.

Answered once per environment you map.

Field	Label	Kind	Required	Advanced	What it is
`appName`	App	text	yes	no	The app whose secrets this environment maps onto.
`deployAfterSync`	Restart machines after each sync	yes or no	yes	yes	Off, secrets reach machines started later. On, we restart them one at a time. Starts at `false`.

penv probes for these when it verifies the connection.

Permission	Directions	Blocking	Without it
`apps:read`	every direction	yes	We cannot confirm the token reaches this organization.
`secrets:write`	`export`	yes	Export cannot write anything.