Agent skill · software engineering · jeremylongshore
flyio-install-auth
Install or upgrade flyctl and establish least-privilege Fly.io authentication with expiry and rotation evidence. Use when onboarding an operator or automation identity. Trigger with: "install flyctl", "create Fly deploy token", "test Fly API auth".
Why this skill is useful
Adds specific commands and procedures for installing and authenticating with the Fly.io CLI that the AI wouldn't reliably generate on its own.
What it needs
Requires flyctl installed locally. Requires fly.io account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Fly.io CLI and Least-Privilege Token Setup Overview Separate interactive login from automation credentials. Current Fly.io guidance provides scoped deploy, organization, read-only, SSH, Machine-exec, and WireGuard token types; choose the smallest authority and lifespan that satisfies the workflow. Prerequisites Named human or workload identity and business owner Target organization, app, commands, environment, and expiry requirement Approved installation source and secret storage location Instructions Step 1: Select the identity mode Use browser login for a human workstation. For automation, map required actions to app deploy, organization deploy, read-only, SSH, Machine-exec, or WireGuard scope. Step 2: Install from an official channel Follow the provider installation method for the operating system, then record fly version and the provider-maintained release tag. Pin CI setup where reproducibility matters. Step 3: Create a scoped expiring token Prefer fly tokens create deploy for one app and fly tokens create readonly for observation. Use organization scope only for justified multi-app operations. Step 4: Store and inject once Place the token in the approved secret manager and expose it only as FLYAPITOKEN or FLYACCESSTOKEN to the intended process. Step 5: Validate the smallest read Confirm effective identity and scope through a non-mutating app or Machine read. Distinguish an empty scoped listing from a failed credential. Step 6: Plan rotation and revocation Record token ID, owner, scope, expiry, dependents, overlap procedure, emergency revocation, and post-rotation verification. Authentication Machines API requests send Authorization: Bearer <token> to the public https://api.machines.dev endpoint outside the private network. The hidden deprecated fly auth token output is an all-powerful short-lived login token and must not be used as the routine CI credential. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/flyio-install-auth--8c89b4