Fly.io secrets from a context

Fly keeps secrets per app in its own vault. Machines get them as environment variables at runtime, not during the image build. Fly does not show the values again: fly secrets list prints names and a digest.

bash
fly secrets list

So the app needs no getmyenv at runtime. getmyenv stays the source, and one command copies a context into Fly when values change. That copy is held by Fly.

In the folder linked to your getmyenv project and holding fly.toml, pipe export into Fly. Elsewhere, add -a your-app to the Fly command.

bash
npx getmyenv export -c production --stdout | fly secrets import

--stdout writes NAME=VALUE lines to the pipe and its notices to stderr. Nothing is written to disk. Fly skips the comment lines export adds, like the line for a name with no value. Setting secrets restarts the app's Machines.

export reads a Read-only context the way run does: with a server token, from an IP on its allowlist, on a trusted or approved machine. A folder token cannot read it. Only the owner sets Read-only values, in the dashboard. With Ask me, the first export from a new machine waits for approval on Requests. A machine's request waits up to 5 minutes for approval.

A server token picks its own context:

bash
export GETMYENV_TOKEN=...   # server token for Production
npx getmyenv export --stdout | fly secrets import

--stage sets the secrets without touching running Machines. They apply with the next fly deploy or fly secrets deploy.

bash
npx getmyenv export -c production --stdout | fly secrets import --stage
fly deploy

• It only sets names. A name you delete in getmyenv stays in Fly. Remove it with fly secrets unset NAME.
• Changes in getmyenv are not copied on their own. Run the command again.
• Fly reads one NAME=VALUE per line. A value with a line break, a # or a single quote does not arrive as it is. Pass those through run, which sets them with no file:

bash
npx getmyenv run production -- sh -c 'fly secrets set PRIVATE_KEY="$PRIVATE_KEY"'

The single quotes keep your shell from expanding $PRIVATE_KEY before run starts.