I might be wrong, but you really don’t want to rely on flyctl anything in prod.
If you want to reach your machine endpoint, a prudent thing would be to allocate it a Public (Anycast) IP address (IPv6 addresses are free!). To reach a specific machine instance behind that Anycast IP, you’d have to do a bit of request-gymnastics.
# one ip free per app?
flyctl ips allocate-v4 -a <machine-app-name>
# any number of them!
flyctl ips allocate-v6 -a <machine-app-name>
If you want public-access to the machine locked-down, consider http basic-auth if you’re using http, if not, some other form of authentication.