Docs
PricingConsole

Rules: access

Last updated 2 November 2026

View .md

Machines are not open yet. These pages describe Machines as they will open; until then, a create answers region_not_offered (422), “Machines are not offered in any region yet.”

Check these rules before you put a credential in a Machine: each keeps it from reaching anyone it should not.

The examples use the database a Machine opens as Keep data in its database shows, and a node:http server.

Put in env only what every member of the account may hold

A Machine has no store for secrets, and every member of the account, and every Agent key of it, reads a Machine’s environment variables through the API, so a credential there is one every member holds (see Environment variables).

Do
tonbo machine create app --image registry.example.com/you/app:1 --shape s-1 --port 8080 --env LOG_LEVEL=info # settings, or a credential every member may use
Don’t
tonbo machine create app --image registry.example.com/you/app:1 --shape s-1 --port 8080 --env PAYMENT_API_KEY=sk_live_... # a key only some members may use

Never build a secret into the image

A Machine’s image is public, so anyone can pull it (see Which images a Machine can use).

Do
FROM node:22-bookworm-slim
WORKDIR /app
COPY package.json package-lock.json server.js ./
RUN npm ci --omit=dev
CMD ["node", "server.js"]
Don’t
FROM node:22-bookworm-slim
WORKDIR /app
COPY . .
# .env and every other file of the folder are published with the image
RUN npm ci --omit=dev
CMD ["node", "server.js"]

Use your own credentials with other services

Machines in a region share one outbound address, so a site’s limits per address are shared with other Machines (see What it can reach).

Do
await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
Don’t
await fetch(url); // anonymous: limited per address, shared with other Machines