---
title: "Use sprites connectors and flyctl to add sprites to your 6pn"
description: "A WireGuard-scoped token in a Sprites connector lets a sprite add itself as a peer on your organization's private network."
date: "2026-11-09"
author: "Eli"
url: "https://fly.io/changelog/use-sprites-connectors-and-flyctl-to-add-sprites-to-your-6pn/"
discussion: "https://community.fly.io/t/use-sprites-connectors-and-flyctl-to-add-sprites-to-your-6pn/29038"
---

# Use sprites connectors and flyctl to add sprites to your 6pn

This is more of an amuse-bouche than an entire vegetable fresh out of the ground, but a few folks have asked about it, so here’s something that’s worked for me.

`fly tokens create wireguard` gives you a token scoped to WireGuard peer management: it can add and remove peers in your org, and read the rest of the org, but not touch your apps. Fly’s GraphQL API has an `addWireGuardPeer` mutation. So you can create a sprites connector with:

* base URL `https://api.fly.io`
* auth header prefix `FlyV1`
* token: everything after `FlyV1` in the output of `fly tokens create wireguard`
* an access policy (an empty one admits no sprites)

Then I spun up [a small Go service](https://github.com/eliferrous/wg6pn), borrowing heavily from flyctl itself, that runs userspace WireGuard on the sprite side of things. It also handles calling out to the connector to grab a peer for your sprite.

I haven’t run any serious workloads on it yet (and for that, I’d probably reach for tailscale, and use a [subnet router](https://community.fly.io/t/connecting-your-fly-apps-to-your-tailscale-tailnet/17828)), but I’m sharing in case the approach is useful to anyone else!