Credentials

Securely manage authentication credentials for registries, Git providers, and cloud platforms.

Credentials in Ankra store authentication information for connecting to external services - Helm and container registries, Git providers, and cloud platforms used for cluster provisioning and cost estimation. Credentials are stored securely in a Vault-compatible secret store (HashiCorp Vault or OpenBao) and referenced by name when configuring integrations and clusters.

Choose a credential type

Registry

Helm chart and container registries (HTTP and OCI).

Git

GitHub, GitLab, and other Git providers for GitOps.

Hetzner

Hetzner Cloud API token for cluster provisioning.

OVH

OVHcloud application keys and Public Cloud project.

DigitalOcean

DigitalOcean personal access token for droplets and DOKS.

UpCloud

UpCloud subaccount API access for servers and UKS.

AWS

IAM role or access keys for cost, inventory, and EKS.

Google Cloud (GCP)

Read-only service account for cost, discovery, and GKE.

Azure

Service principal for provisioning AKS (early access).

Proxmox VE

Proxmox API URL and token for self-managed clusters.

Morpheus

Morpheus appliance URL and access token.

SSH Key

SSH keys for server access on self-managed clusters.

Compare credential types

Credential	Used for	CLI command	Guide
Registry	Sync Helm charts / images from private registries	— (UI/API)	Registry
Git	GitOps configuration sync	— (via GitHub App)	Git
Hetzner	Provision Hetzner clusters	ankra credentials hetzner	Hetzner
OVH	Provision OVH clusters and OVHcloud MKS	ankra credentials ovh	OVH
DigitalOcean	Provision droplet clusters and DOKS	ankra credentials digitalocean	DigitalOcean
UpCloud	Provision UpCloud clusters and UKS	ankra credentials upcloud	UpCloud
AWS	Cost, inventory, and EKS	— (UI/API)	AWS
Google Cloud (GCP)	Cost, discovery, and GKE	— (UI/API)	GCP
Azure	Provision AKS (early access - via support)	—	Azure
Proxmox VE	Provision self-managed Proxmox clusters	— (UI/API)	Proxmox VE
Morpheus	Provision self-managed Morpheus clusters	— (UI/API)	Morpheus
SSH Key	Server access on self-managed clusters	ankra credentials <provider> ssh-key (Hetzner, OVH, DigitalOcean, UpCloud)	SSH Key

---

Using credentials

Credentials are selected by name where they’re needed:

• Registries: when adding a Helm registry, pick the registry credential from the dropdown.
• Clusters: when provisioning or importing a cluster, pick the matching cloud credential (and an SSH key for self-managed clusters).
• GitOps: the Git connection is used automatically when syncing configuration.

---

Managing credentials

View credentials

Go to Credentials to see all stored credentials as cards - each card shows the provider, credential type, health, and when it was last updated. Filter by name or provider, sort, and select multiple cards for bulk deletion.

Opening a credential shows its identity - provider, availability, whether it is in use, and when it was created - with the rest organised into tabs:

• Overview - the identity fields the credential authenticates with (secret values stay masked or in the platform’s secret store) and a Verify connection check that probes the provider API with the stored credential.
• Capacity - the live capacity and usage report, for cloud providers (see below).
• Used by - the clusters running on this credential and any operations currently holding it.
• Rotation - in-place secret rotation, for providers that support it.

Capacity and usage

Open any cloud provider credential and switch to the Capacity tab for a live capacity report read from the provider with that credential:

• Hetzner shows project usage: servers with their combined vCPUs, memory, and disk, volumes, load balancers, floating and primary IPs, networks, firewalls, and SSH keys. Hetzner does not expose project limits through its API, so the view shows usage only.
• Proxmox VE shows the total resources of the cluster behind the credential: each node with used and total CPU and memory, storage pools (shared pools counted once), and how many guests are running with the vCPUs and memory allocated to them.
• UpCloud shows the account’s resource limits (CPU cores, memory, storage, IPs, networks, load balancers) as usage bars, plus remaining credits.
• DigitalOcean shows account limits (droplets, floating and reserved IPs) with usage against them, droplet resource sums, volumes, and load balancers.
• OVHcloud shows the project’s per-region quotas: vCPUs, instances, memory, and volume storage as usage bars per region and in total, plus volume and load balancer counts.
• Scaleway shows project usage swept across zones: servers with real vCPU and memory sums, storage, and load balancers. Scaleway does not expose quota headroom through its APIs, so the view shows usage only.
• HPE Morpheus shows each cloud on the appliance with used and total memory and storage plus CPU load, and the appliance’s instance and host counts.
• Azure shows the subscription’s virtual machine and AKS cluster counts, with regional vCPU and VM quota bars for the regions currently in use.

The report is read from the provider API when you open the credential, so it reflects everything in the account, including resources created outside Ankra.

Update a credential

Identity fields are fixed - a credential always points at the same account or infrastructure. What changes is the secret material, and that rotates in place:

1. Click on the credential name
2. Open the Rotation tab
3. Enter the new secret and click Verify & rotate

The new secret is verified against the provider before anything is saved, so a failed rotation never breaks the working credential.

Rotating a credential automatically applies to everything using it. No need to reconfigure registries or clusters.

Delete a credential

1. Go to Credentials
2. Click the menu (⋮) next to the credential
3. Select Delete

Deleting a credential will break authentication for anything using it. Update those integrations first.

AI and MCP access

Ankra’s AI and MCP clients can list and inspect credentials (secret fields are always redacted), validate names, delete unused credentials, and plan and apply a GitHub credential rotation - but they can never create a credential, because that would mean passing the secret itself to the AI, which the platform refuses. See the MCP Tool Reference.

---

Security

Storage

Credentials are stored securely in a dedicated secret store (HashiCorp Vault or OpenBao):

• Encrypted at rest
• Access controlled per organisation
• Audit logging for all access

Best practices

Use Tokens, Not Passwords

Prefer access tokens over account passwords. Tokens can be scoped and revoked independently.

Minimum Permissions

Grant only the permissions needed. For chart sync and cost, read-only access is enough.

Rotate Regularly

Rotate credentials periodically, especially for production.

Separate by Environment

Use different credentials for dev, staging, and production.

---

Troubleshooting

Authentication errors

Error	Cause	Solution
401 Unauthorized	Invalid credentials	Verify username and password/token
403 Forbidden	Insufficient permissions	Check the token has required scopes
Token expired	Temporary tokens (ECR)	Refresh the token
Connection refused	Network issue	Check firewall and network access

For provider-specific troubleshooting, see the individual credential pages (for example GCP).

---

API access

Manage credentials via the Ankra API:

import requests

headers = {"Authorization": f"Bearer {TOKEN}"}

# List credentials
response = requests.get(
    "https://platform.ankra.app/api/v1/credentials",
    headers=headers
)

# Create credential
response = requests.post(
    "https://platform.ankra.app/api/v1/credentials",
    headers=headers,
    json={
        "name": "my-registry-auth",
        "provider": "registry",
        "username": "myuser",
        "password": "mytoken"
    }
)

See the API Reference for complete documentation.