Hetzner integration
Run your Hetzner servers and DNS without living in the console
Connect a Hetzner project and every server, volume, firewall, network, DNS zone and certificate in it appears in InfraNest — beside everything you run at other providers. Reboot a machine, fix a record or check an expiry date without opening the Cloud Console.
Free plan · About 2 minutes · One token covers cloud and DNS
- Servers, volumes, firewalls and networks, all controllable
- Zones found and imported the moment you connect
- Resources you can lock against accidental deletion
- Certificate expiry watched with everything else
15 servers · 13 running
Point-in-time copies of your server disks, kept even after a server is deleted.
Floating IP addresses you can attach to and move between your servers.
4 servers are polled by their provider, so memory, disk space and load are not being measured on them.
DigitalOcean — Staging1 of 5€204.00/moHetzner — Production2 of 6€149.59/mo
OVHcloud — Beauharnois1€12.00/mo
TransIP — Amsterdam1 of 2€60.00/mo15 servers across 5 accounts · €425.59/mo
web-01 golden imageProtectedfrom web-01 · 80 GB disk · 6.2 GB stored6.2 GBdb-01 nightlyfrom db-01 · 40 GB disk · 11.1 GB stored11.1 GBshop-old before shutdownfrom shop-old · 80 GB disk · 21.5 GB stored21.5 GBqueue-01 weeklyfrom queue-01 · 80 GB disk · 14.2 GB stored14.2 GBapi-01 before the 2.4 rolloutfrom api-01 · 60 GB disk · 9.8 GB stored9.8 GBstaging-data before the 2.4 migration100 GB disk · 5.9 GB stored5.9 GBstaging-data nightly100 GB disk · 6.4 GB stored6.4 GBdb-01 before schema migrationProtectedfrom db-01 · 40 GB disk · 11.4 GB stored11.4 GBmail-01 pre-upgradeProtectedfrom mail-01 · 75 GB disk · 18.6 GB stored18.6 GB9 snapshots · 105.1 GB stored
3 attached to nothing — €6.30 a month
A reserved address keeps billing after the server it was reserved for is gone. Release it at your provider, or attach it to a server.
14 addresses across 4 accounts
Your Hetzner servers, without the Cloud Console
Connect a project and every server in it appears with its specs, region and state, in the same list as the machines you run elsewhere. Power them on and off, reboot, rebuild, take snapshots and manage backups — and the rest of the project comes with them, so the routine jobs stop being a reason to open the console at all.
- Power, reboot, rebuild, snapshots and backups
- Volumes and firewalls on Pro, private networks and load balancers on Business
- Specs, region and state beside every other provider you run
- More than one project? Connect each one and keep them apart
Manual point-in-time copies you take yourself.
web-01 golden imageProtectedfrom web-01 · 80 GB disk · 6.2 GB stored6.2 GBdb-01 nightlyfrom db-01 · 40 GB disk · 11.1 GB stored11.1 GBshop-old before shutdownfrom shop-old · 80 GB disk · 21.5 GB stored21.5 GB9 snapshots, 3 protected from deletion — 655 GB of disk stored as 105.1 GB, 84% smaller.
For when SSH refuses, the server will not finish booting, or a firewall rule shut you out.
Credentials are temporary, requested per session and expiring shortly after. Opening one is written to the audit log, so the team can see who connected and when.
Lock what must not be deleted by accident
A server, volume, firewall, network or load balancer can be locked against deletion, and the lock holds wherever in InfraNest the delete comes from — a single click, a bulk action, or an automation running on its own at three in the morning. It is the protection that matters most on the provider where a machine is one click from gone.
- Lock servers, volumes, firewalls, networks and load balancers
- Enforced for bulk actions and automations, not just single clicks
- A delete made in Hetzner’s own dashboard needs Hetzner’s lock as well
Delete — the machine goes
Destroys mail-01 at your provider. The billing stops.
At TransIP this is a cancellation: the machine keeps running until the end of the period you have already paid for.
Of your accounts, only TransIP works that way — and the confirmation says which of the two you are about to do.
Type the server name to confirm deletion:
Plus your organisation’s re-authentication where it is required — passkey, code or password. The capability check runs first, so you are never asked for a passkey for an action the provider was never going to allow.
Stop tracking — the machine stays
mail-01 will disappear from your server list, monitoring and cost reports. Nothing happens to the machine itself.
The server keeps running and your provider keeps charging for it. To stop paying, delete it at the provider instead.
You can bring it back at any time from Servers → Not tracked. Its metrics, tags and settings are kept.
No re-authentication, deliberately: gating the reversible button would push people towards the one that is not.
Two locks, and either one is enough to refuse
InfraNest’s delete lock
Guards deletion, rebuild and restore through InfraNest (and, where supported, the provider). It can’t stop changes made in your provider’s own dashboard.
TransIP’s own protection
TransIP declares no protection of its own, so ours is the only lock. That is not reported as “off” — the cloud simply never offered one.
Enforced at the deletion itself rather than on the API route, so it also refuses a rebuild, and a delete arriving from an automation or a background job.
DNS for any domain, wherever it is registered
Hetzner DNS will host a zone for any domain you point at it, whoever you bought the name from — and InfraNest finds the zones you already have when you connect, so there is nothing to re-enter. Records are created, edited and deleted in the same editor as every other provider’s, and each one keeps its own identity at Hetzner, so an edit changes exactly the record you meant and a change made outside InfraNest still lines up here.
- Existing zones discovered and imported on connect
- Create, edit and delete records for any domain pointed at Hetzner DNS
- An edit changes the record you meant, not one that looks like it
- Changes made outside InfraNest still match up correctly
Certificate expiry, watched with everything else
Certificates held at Hetzner appear in your certificate list with their expiry dates — beside the ones at your other providers and the ones your servers issued themselves. Checking becomes something you do once, in one place, instead of project by project until you forget.
- Hetzner certificates listed with their expiry dates
- One list across every provider and every server
- Told before a certificate expires, rather than after
See your own Hetzner project in InfraNest
Free plan, no credit card. Connect a project and your servers, zones and certificates appear on their own.
Connect Hetzner in about two minutes
One API token from your Hetzner project, covering cloud and DNS together. Read & Write if you want to manage things from here — a read-only token still shows you everything.
- 1
Create a Read & Write API token
Generate the token this connection will use, under Security → API Tokens in your Hetzner Cloud project.
- 2
Open the Hetzner integration
Go to Integrations, open Hetzner, and pick which features to use it for: Cloud, DNS and Certificates.
- 3
Paste the token and connect
Paste your API token and select Connect — your servers, zones and certificates start appearing right away.
That’s it — Hetzner is connected.
Full setup guideSet up with AI
I use Hetzner Cloud, and I want to connect it to InfraNest (infranest.io) — it manages servers, DNS and certificates across providers. It needs a Hetzner API token, created in the project under Security → API Tokens. Walk me through creating one: where that screen is, what the difference between Read and Read & Write means for this, and whether one token really covers both cloud resources and DNS. Then tell me how to check the token works before I paste it in.
What syncs
What InfraNest keeps in sync with Hetzner.
| Cloud resources | Servers, volumes, firewalls, networks and load balancers |
| DNS zones | DNS zones and records |
| Certificates | Certificates and their expiry |
What still happens at Hetzner
InfraNest can't register, renew or transfer domains through Hetzner — that's done at your registrar; this integration only manages the DNS zones that point to them.
MCP server
Hetzner in Claude and ChatGPT
Connect your AI assistant to InfraNest and ask about your Hetzner account in plain words, next to every other provider you use. It reads, and acts only when you allow it.
- Which of my Hetzner servers are running out of disk?
- Where does shop.example.com point, and did anything change there this week?
- Which certificates expire this month, and does anything renew them?
Questions about the Hetzner integration
#Will this find DNS zones I already have on Hetzner?
Yes. When you connect, InfraNest looks for existing zones in your Hetzner project and imports them automatically, including zones for domains registered elsewhere.
#Can InfraNest tell if someone edits a DNS record outside InfraNest?
Yes. Every record has its own identifier at Hetzner, so InfraNest can tell when a record was changed somewhere else and an edit from InfraNest always changes exactly the record you meant.
#What happens if I set delete protection on a server?
InfraNest sets Hetzner's own lock on the resource at the same time, so deleting it is refused whether someone tries from InfraNest, the Hetzner console, the API or a bulk action.
#What if my API token is revoked or expires?
InfraNest will flag that authentication failed; generate a new Read & Write token in the Hetzner Cloud Console and reconnect to pick back up where you left off.
#Can InfraNest change anything in my Hetzner account directly?
Yes — with a Read & Write token, InfraNest can create, edit and delete DNS records and manage cloud resources, and those changes are sent straight to Hetzner.
#What do I need before connecting Hetzner?
A Hetzner API token with Read & Write access, created in your Hetzner Cloud project — see the setup guide.
#Is there a Hetzner MCP server?
Yes, through InfraNest. Once Hetzner is connected, InfraNest’s MCP server lets Claude, ChatGPT, Cursor, VS Code and other assistants read your servers, DNS records and certificates at Hetzner, together with every other provider you use. It works on every plan, including Free.
Bring Hetzner into one dashboard
Connect a project in about two minutes, then add the next provider. Everything you run, in one place.
Free plan · No credit card required · Set up in minutes