Create OVHcloud API keys

Use this if you need to connect InfraNest to OVHcloud manually, because the one-click option isn't available for your setup.

NoteYou only need this if Connect with OVHcloud isn't offered on the connection screen. When it is, use that instead — it's quicker and there's nothing to copy or rotate. Setting up Connect with OVHcloud itself is an administrator job, not a customer one — see the section at the end of this article. A service account is not the right thing for that.

Overview

• OVHcloud gives you three values at once: an Application Key, an Application Secret and a Consumer Key.
• All three go into InfraNest's connection screen for OVHcloud.
• The keys you create determine exactly what InfraNest can see and do in your OVHcloud account.

Create the keys

1. Go to the token page for your region — this must match the region you picked in InfraNest:

   • Europe — eu.api.ovh.com/createToken
   • Canada / Asia-Pacific — ca.api.ovh.com/createToken
   • United States — api.us.ovhcloud.com/createToken

2. Sign in with your OVHcloud account.

3. Fill in a Script name (for example InfraNest) and a description, so you recognise it later.

4. Set Validity to Unlimited, unless you want to rotate the keys yourself on a schedule.

5. Under Rights, add one line per row below. The link in InfraNest opens this page with every row already filled in, so this table is here for checking rather than typing.

   Domains and DNS

   Method	Path	Why
   GET	/domain	List your domains
   GET	/domain/*	Read a domain's details, nameservers, DNS zones
   POST	/domain/*	Change nameservers, contacts, DNSSEC
   PUT	/domain/*	Transfer lock, auto-renew, DNS records
   DELETE	/domain/*	Delete DNS records

   Buying and pricing domains

   Method	Path	Why
   POST	/order/cart	Start a price or availability lookup
   POST	/order/cart/*	Register or transfer a domain
   GET	/order/cart/*	Read the prices back
   DELETE	/order/cart/*	Tidy the lookup away again

   Servers (only if you run VPS at OVHcloud)

   Method	Path	Why
   GET	/vps	List your VPS
   GET	/vps/*	Read a VPS, its IPs and its backups
   POST	/vps/*	Start, stop, reboot, reinstall, take a snapshot
   PUT	/vps/*	Rename it, edit reverse DNS
   DELETE	/vps/*	Delete a snapshot

   NoteNothing outside these three areas is needed — InfraNest never asks for access to your account itself. Also, /domain and /domain/* are two separate rules — the * covers everything below /domain, but not /domain itself. Miss the first row and listing your domains fails with "This call has not been granted" while everything else works. The same applies to /order/cart and /vps, which is why each appears twice above.

   TipAlready have a key? Keys created before domain registration and VPS support were added don't have the POST /order/cart/* or DELETE /vps/* rows. Everything else keeps working, but buying a domain or deleting a snapshot fails with "This call has not been granted". Create a fresh set of keys from the link above and paste them in — nothing is lost, and no domain is ever half-bought by this.

6. Select Create keys.

Copy them into InfraNest

OVHcloud now shows the three values once. Copy each into the matching field on the InfraNest connection screen:

1. Copy the Application Key from OVHcloud and paste it into the Application Key field.
2. Copy the Application Secret from OVHcloud and paste it into the Application Secret field.
3. Copy the Consumer Key from OVHcloud and paste it into the Consumer Key field.
4. Select Save changes.

If you close the page before copying them, you can't get them back — create a new set and delete the old one.

Tips

• The rights you grant are the rights InfraNest has. Only the /domain/* paths are needed for DNS and domains. Don't grant /*.
• Keys are per region. Keys made on the European page won't work if the connection is set to United States.
• To revoke access, go to your OVHcloud account under API keys and delete the entry. The connection in InfraNest will start reporting errors, which is what you want.

Troubleshooting

• "Authentication failed" — check the region matches where you created the keys, and that all three values were pasted without stray spaces.
• Reads work but changes fail — you likely only granted GET. Add POST, PUT and DELETE on /domain/*, or create a new set of keys with all four.

For administrators: enabling "Connect with OVHcloud"

This part is for whoever runs the InfraNest platform, and it's the step OVHcloud's own documentation makes easy to get wrong.

A service account will not work. OVHcloud's control panel offers service accounts, which use the CLIENT_CREDENTIALS flow — they authenticate as themselves, machine-to-machine. That's why a service account gives you an id and a password but no field for a callback URL, and why sending a user to it shows an "You are logged in as…" page with a Customer Center button instead of an Allow button. There is nothing to approve, because nobody is being asked for permission.

What you need is an OAuth2 client using the AUTHORIZATION_CODE flow, which the control panel does not create — it has to be made through the API:

1. Open the API console for your region — eu.api.ovh.com/console (or the ca / us equivalent).

2. Find POST /me/api/oauth2/client and select Authenticate (a browser login; no keys needed).

3. Send:

   {
     "name": "InfraNest",
     "description": "InfraNest one-click connect",
     "flow": "AUTHORIZATION_CODE",
     "callbackUrls": ["https://your-infranest-url/api/provider-oauth/ovh/callback"]
   }
   

   The callback URL must match exactly what Admin → Integrations → OVHcloud shows; there's a copy button next to it.

4. The response contains a clientId and a clientSecret. The secret is shown once.

5. Paste both into the slot for your region in Admin → Integrations → OVHcloud.

Each region is a separate platform, so it needs its own client created on its own console. Regions you leave blank simply keep using the API-key method above.

Nothing else is needed on the customer's side. Approving the connection is enough — they don't have to set up an access policy in OVHcloud first, which is the whole reason this is quicker than creating keys.

WarningIf a connection succeeds but every call then fails with "User not granted for this request", the connection was made before this was fixed. The permissions are decided at the moment someone approves the connection, so an older one can't be repaired in place — disconnect it and connect again.