[miguel-fly]

Problem

• The docs don't cover WireGuard tokens.
• fly tokens create wireguard is getting a --network flag that limits a token to named private networks.

Solution

• A short "Create an org-scoped WireGuard token" section in security/tokens.mdx, with the --network flag.
• One linking line in flyctl/integrating.mdx and in networking/custom-private-networks.mdx.

Notes

• Part of https://github.com/superfly/mpg/issues/547.
• The flag comes from Limit WireGuard tokens to networks with --network flyctl#5446.

Rollout

• Merge after the flyctl release that has --network, and after the web and gateway changes are deployed. Until then, fly wireguard create refuses a network-limited token.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
fly-io	🟢 Ready	View Preview	Nov 13, 2026, 5:59 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[kcmartin]

Checked against flyctl#5446 and it matches. Holding until #5446 ships in a release and nomad-firecracker#5305 and the web change are deployed, per your rollout note. Two small things:

• "keep a token to the networks it needs": suggested "limit" is listed as an inline suggestion.
• The default-network paragraph is a bit hard to follow because --network default means different things on the two commands. A short list might be clearer:
  • Token allows the default network: fly tokens create wireguard --network default
  • Peer on the default network: fly wireguard create <org> <region> <name> (no --network)
  • fly wireguard create --network default means a custom network named default.

[kcmartin]

LGTM!