Create OVHcloud API keys

Create the Application Key, Application Secret and Consumer Key that let InfraNest manage your OVHcloud domains, DNS and servers. This is for anyone connecting an OVHcloud account to InfraNest by hand.

#Overview

• OVHcloud gives you three values at once — an Application Key, an Application Secret and a Consumer Key — and all three go into InfraNest.
• You only need to do this if Connect with OVHcloud isn't offered on the connection screen. When it is, use it instead — it's quicker and there's nothing to copy or rotate.

NoteSetting up Connect with OVHcloud itself is an administrator job, not a customer one — see the end of this article. A service account is not the right thing for it.

#Create the keys

1. Go to the token page for your region — this must match the region you picked in InfraNest:

   • Europe — eu.api.ovh.com/createToken
   • Canada / Asia-Pacific — ca.api.ovh.com/createToken
   • United States — api.us.ovhcloud.com/createToken

2. Sign in with your OVHcloud account.

3. Fill in a Script name (for example InfraNest) and a description, so you recognise it later.

4. Set Validity to Unlimited, unless you want to rotate the keys yourself on a schedule.

5. Under Rights, add the required rows. The link InfraNest gives you opens this page with every row already filled in:

   • Domains and DNS: GET /domain, GET /domain/*, POST /domain/*, PUT /domain/*, DELETE /domain/*
   • Buying and pricing domains: POST /order/cart, POST /order/cart/*, GET /order/cart/*, DELETE /order/cart/*
   • Servers (only if you run VPS at OVHcloud): GET /vps, GET /vps/*, POST /vps/*, PUT /vps/*, DELETE /vps/*

   Note/domain and /domain/* are two separate rules — the * covers everything below /domain, but not /domain itself. Miss the first row and listing your domains fails while everything else works. The same applies to /order/cart and /vps, which is why each appears twice above.

6. Select Create keys.

#Copy them into InfraNest

1. OVHcloud shows the three values once. Copy each into the matching field on the InfraNest connection screen:
   • Application Key → Application Key
   • Application Secret → Application Secret
   • Consumer Key → Consumer Key
2. If you close the page before copying them, you can't get them back — create a new set and delete the old one.

#Tips

TipAlready have a key? Keys created before domain registration and VPS support were added won't have the POST /order/cart/* row or any /vps rows. DNS and domains keep working, but buying a domain fails, and the connection can't be used for Cloud until it has keys with the /vps rows. Create a fresh set from the link above and paste them in — nothing is lost.

• The rights you grant are the rights InfraNest has. Don't grant /*.
• Keys are per region. Keys made on the European page won't work if the connection is set to United States.
• To revoke access, go to your OVHcloud account under API keys and delete the entry. The connection in InfraNest will start reporting errors, which is what you want.

#Troubleshooting

• "Authentication failed" — check the region matches where you created the keys, and that all three values were pasted without stray spaces.
• Reads work but changes fail — you likely only granted GET. Create a new set of keys from the link with all four methods on /domain/* (and on /vps/* for server actions).

#For administrators: enabling "Connect with OVHcloud"

This part is for whoever runs the InfraNest platform.

A service account will not work. OVHcloud's control panel offers service accounts, which authenticate machine-to-machine and have no field for a callback URL — sending a user to one shows a "You are logged in as…" page with a Customer Center button instead of an Allow button, because nobody is being asked for permission.

What you need is an OAuth2 client using the authorization-code flow, which the control panel does not create — it has to be made through the API:

1. Open the API console for your region — eu.api.ovh.com/console (or the ca / us equivalent).
2. Find POST /me/api/oauth2/client and select Authenticate (a browser login; no keys needed).
3. Send a request naming the client, describing it, setting the flow to AUTHORIZATION_CODE, and giving the callback URL shown in Admin → Integrations → OVHcloud (there's a copy button next to it).
4. The response contains a clientId and a clientSecret. The secret is shown once.
5. Paste both into the slot for your region in Admin → Integrations → OVHcloud.

Each region is a separate platform, so it needs its own client created on its own console. Regions you leave blank simply keep using the API-key method above.

Nothing else is needed on the customer's side — approving the connection is enough.

WarningIf a connection succeeds but every call then fails with "User not granted for this request", the connection was made before this was fixed. Permissions are decided at the moment someone approves the connection, so an older one can't be repaired in place — disconnect it and connect again.