Fly.io

What it watches

Fly.io feeds Publishes — Every deploy gets a verdict within five minutes — as Publish Verification.

What Keelnest reads

Access token · read apps, releases, certificates and secret names.

Fly sends no deploy webhook of its own, so releases are found on the five-minute poll rather than within seconds. Fly has no branch previews either, so a repair on Fly is verified by review.

Read-only, like every connection: Keelnest never refunds, charges, changes a price, edits a setting or an environment variable, merges on its own or runs a migration. The credential is checked with one read call before it is stored, encrypted at rest, and can be revoked at the provider at any time. Security says the whole of it.

How to connect

1. Create the access token. Fly.io dashboard > Account > Access tokens > Create token (read-only is enough), or `fly tokens create readonly`. Open Fly.io.
2. Paste it into Keelnest. In your workspace, open Integrations, find Fly.io and press Connect. Keelnest makes one read call to confirm the credential works, stores it encrypted, and starts reading on the next five-minute tick.
3. Link the apps. Under Manage, pick which applications this account watches. An app linked to a host is checked the moment that host reports a deploy; an app linked to a payment or AI account starts building its baseline from that hour.

Deploy notifications

Fly.io sends no deploy notification of its own, so Keelnest finds a Fly release by asking Fly every five minutes. Checks start within a few minutes of a deploy rather than within seconds, and that wait is Fly's rather than Keelnest's.

Where to set it up. Fly.io has no deploy webhook to turn on. If you deploy from CI, add one line after `fly deploy` that calls the address below with the secret below as an `X-Keelnest-Secret` header, and checks start within seconds. If you deploy from your own machine, nothing needs doing: the five-minute poller covers Fly.

The address and the secret to paste are shown in Keelnest under Integrations › Fly.io › Manage, one pair per connected account.

How a delivery is checked. Nothing Fly sends. A deploy step of your own can call the address with the secret in an x-keelnest-secret header, and that is checked; Fly itself sends no deploy webhook. A delivery is never trusted on its own: it says which site to look at first, and every fact about the deploy is then read back from Fly.io’s API, so a forged or missed delivery changes nothing the next poll would not correct.

Source: Fly.io’s documentation.

Start watching

Create a workspace and connect Fly.io from Integrations, or run the free check on any public URL first. All docs.