> Fetch the index of every Tonbo docs page as Markdown at https://tonbo.dev/llms.txt

# Rules: access

Last updated 2 November 2026

> Machines are not open yet. These pages describe Machines as they will open; until then, a create answers [`region_not_offered`](https://tonbo.dev/docs/machines/troubleshooting/manage.md#region_not_offered) (422), “Machines are not offered in any region yet.”

Check these rules before you put a credential in a Machine: each keeps it from reaching anyone it should not.

The examples use the database a Machine opens as [Keep data in its database](https://tonbo.dev/docs/machines/database.md#open) shows, and a `node:http` server.

### Put in env only what every member of the account may hold

A Machine has no store for secrets, and every member of the account, and every Agent key of it, reads a Machine’s environment variables through the API, so a credential there is one every member holds (see [Environment variables](https://tonbo.dev/docs/machines/images.md#env)).

**Do**

```shell
tonbo machine create app --image registry.example.com/you/app:1 --shape s-1 --port 8080 --env LOG_LEVEL=info # settings, or a credential every member may use
```

**Don’t**

```shell
tonbo machine create app --image registry.example.com/you/app:1 --shape s-1 --port 8080 --env PAYMENT_API_KEY=sk_live_... # a key only some members may use
```

### Never build a secret into the image

A Machine’s image is public, so anyone can pull it (see [Which images a Machine can use](https://tonbo.dev/docs/machines/images.md#public)).

**Do**

```text
FROM node:22-bookworm-slim
WORKDIR /app
COPY package.json package-lock.json server.js ./
RUN npm ci --omit=dev
CMD ["node", "server.js"]
```

**Don’t**

```text
FROM node:22-bookworm-slim
WORKDIR /app
COPY . .
# .env and every other file of the folder are published with the image
RUN npm ci --omit=dev
CMD ["node", "server.js"]
```

### Use your own credentials with other services

Machines in a region share one outbound address, so a site’s limits per address are shared with other Machines (see [What it can reach](https://tonbo.dev/docs/machines/guarantees/network.md#outbound)).

**Do**

```js
await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
```

**Don’t**

```js
await fetch(url); // anonymous: limited per address, shared with other Machines
```