Leaked Fly.io Access Token? Revoke It and Audit Apps

A Fly.io access token authenticates the flyctl command line and the Fly API. Depending on how it was issued, it can be limited to one app or cover a whole organization. With a broad token, an attacker can deploy images, start and stop machines, open SSH sessions to them, read and set app secrets, and attach volumes. Revoke the token first, then work out how far it reached.

Check your GitHub account for leaked secrets — free

Provider: Fly.io
Severity: Critical
Impact: Cloud infrastructure access
Checked live by LeakWatch: No

What a Fly.io access token looks like

Fly.io tokens come in several shapes, all recognisable by a prefix:

fo1_…XXXX    organization token, classic (masked, 43 characters after the prefix)
fm1a_…XXXX   macaroon access token (masked, long base64 string)
fm1r_…XXXX   macaroon refresh token (masked, long base64 string)
fm2_…XXXX    macaroon token, newer generation (masked, long base64 string)

The fo1_ form has a fixed length. The fm forms are macaroons: signed tokens that carry the permissions attached to them, encoded in base64, so they are much longer, often more than a hundred characters, and may end with one or more = signs. A variable called FLY_API_TOKEN is the usual home of either. Do not confuse them with the application secrets you set with fly secrets, which are your own values and have no fixed format.

How Fly access tokens get leaked

CI pipelines. FLY_API_TOKEN hardcoded in a workflow file rather than stored as a secret.
Environment files. A .env file or a Dockerfile ENV line that bakes the token into an image.
Config files. A copy of the flyctl configuration file from a home directory, committed with a dotfiles repository.
Logs. A deploy log or fly auth token output pasted into a bug report or a forum post.
Macaroon length. A very long token is easy to paste into a ticket or a screenshot without noticing what it is.

What to do in the first hour

List your tokens. Use fly tokens list from the command line, or open the tokens section of the Fly dashboard. Match the name, scope and creation date against what leaked.
Create a narrower replacement. For a deployment pipeline, a token limited to a single app is a better fit than an organization token. Store it in your CI secret store.
Deploy the new token and confirm that a release still works.
Revoke the exposed token from the dashboard or with the fly tokens revoke command and the ID shown in the list. Requests with a revoked token are rejected.
Review activity. List the apps, machines and images of the organization, and look for machines you did not create, unexpected regions, new volumes, changed IP addresses and new certificates.
Rotate app secrets. If the token could read or set secrets, rotate the database passwords and third-party keys stored in them at their own provider.
Check the rest of the repository. See I accidentally pushed an API key to GitHub.

Not sure what else leaked from the same repository? Run a free scan.

Not sure what else leaked? Run a free scan.

Revoke it at Fly.io

Fly tokens are managed from the tokens section of the dashboard and from the fly tokens command group in flyctl. Sign in with an account that has access to the organization, find the exposed token and revoke it. For a token created by a deploy command, check the names listed to identify it. Fly documents the available token types and how to scope them. The dashboard and command names can change, so if what you see differs from this guide, look for the place where tokens are listed.

How LeakWatch detects it

The rule is called Fly.io Access Token. It recognises three families by prefix and length: fo1_ followed by exactly 43 characters, and the fm1a_, fm1r_ and fm2_ macaroon forms with at least 100 base64 characters and optional = padding. A prefix with the wrong length is not reported. The severity is critical, since a broad token controls running infrastructure. This type is not checked live: LeakWatch does not test the value against Fly.io, so a finding means the string was seen, not that it still works.

LeakWatch detects this format but does not check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it.

FAQ

Can someone open a shell on my machines with this token?

With a token scoped to the organization or to the app, yes, the Fly API allows it. Review your machines and revoke the token; also rotate any secret that was available inside them.

Why are some of the tokens so long?

Macaroon tokens embed the permissions they grant, signed and base64 encoded. The length is not a sign of strength you can rely on once the string is public.

Should a CI token have organization scope?

Preferably not. A token limited to one app limits what a leak can do. Use the narrowest scope that lets the pipeline deploy.