> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials

> Securely manage authentication credentials for registries, Git providers, and cloud platforms.

Credentials in Ankra store authentication information for connecting to external services - Helm and container registries, Git providers, and cloud platforms used for cluster provisioning and cost estimation. Credentials are stored securely in a Vault-compatible secret store (HashiCorp Vault or OpenBao) and referenced by name when configuring integrations and clusters.

## Choose a credential type

<CardGroup cols={2}>
  <Card title="Registry" icon="box" href="/platform/credentials/registry">
    Helm chart and container registries (HTTP and OCI).
  </Card>

  <Card title="Git" icon="code-branch" href="/platform/credentials/git">
    GitHub, GitLab, and other Git providers for GitOps.
  </Card>

  <Card title="Hetzner" icon="cloud" href="/platform/credentials/hetzner">
    Hetzner Cloud API token for cluster provisioning.
  </Card>

  <Card title="OVH" icon="cloud" href="/platform/credentials/ovh">
    OVHcloud application keys and Public Cloud project.
  </Card>

  <Card title="DigitalOcean" icon="digital-ocean" href="/platform/credentials/digitalocean">
    DigitalOcean personal access token for droplets and DOKS.
  </Card>

  <Card title="UpCloud" icon="cloud" href="/platform/credentials/upcloud">
    UpCloud subaccount API access for servers and UKS.
  </Card>

  <Card title="AWS" icon="aws" href="/platform/credentials/aws">
    IAM role or access keys for cost, inventory, and EKS.
  </Card>

  <Card title="Google Cloud (GCP)" icon="google" href="/platform/credentials/gcp">
    Read-only service account for cost, discovery, and GKE.
  </Card>

  <Card title="Azure" icon="microsoft" href="/platform/credentials/azure">
    Service principal for provisioning AKS (early access).
  </Card>

  <Card title="Proxmox VE" icon="server" href="/platform/credentials/proxmox">
    Proxmox API URL and token for self-managed clusters.
  </Card>

  <Card title="Morpheus" icon="server" href="/platform/credentials/morpheus">
    Morpheus appliance URL and access token.
  </Card>

  <Card title="SSH Key" icon="lock" href="/platform/credentials/ssh-key">
    SSH keys for server access on self-managed clusters.
  </Card>
</CardGroup>

## Compare credential types

| Credential         | Used for                                          | CLI command                                                                  | Guide                                              |
| ------------------ | ------------------------------------------------- | ---------------------------------------------------------------------------- | -------------------------------------------------- |
| Registry           | Sync Helm charts / images from private registries | — (UI/API)                                                                   | [Registry](/platform/credentials/registry)         |
| Git                | GitOps configuration sync                         | — (via GitHub App)                                                           | [Git](/platform/credentials/git)                   |
| Hetzner            | Provision Hetzner clusters                        | `ankra credentials hetzner`                                                  | [Hetzner](/platform/credentials/hetzner)           |
| OVH                | Provision OVH clusters and OVHcloud MKS           | `ankra credentials ovh`                                                      | [OVH](/platform/credentials/ovh)                   |
| DigitalOcean       | Provision droplet clusters and DOKS               | `ankra credentials digitalocean`                                             | [DigitalOcean](/platform/credentials/digitalocean) |
| UpCloud            | Provision UpCloud clusters and UKS                | `ankra credentials upcloud`                                                  | [UpCloud](/platform/credentials/upcloud)           |
| AWS                | Cost, inventory, and EKS                          | — (UI/API)                                                                   | [AWS](/platform/credentials/aws)                   |
| Google Cloud (GCP) | Cost, discovery, and GKE                          | — (UI/API)                                                                   | [GCP](/platform/credentials/gcp)                   |
| Azure              | Provision AKS (early access - via support)        | —                                                                            | [Azure](/platform/credentials/azure)               |
| Proxmox VE         | Provision self-managed Proxmox clusters           | — (UI/API)                                                                   | [Proxmox VE](/platform/credentials/proxmox)        |
| Morpheus           | Provision self-managed Morpheus clusters          | — (UI/API)                                                                   | [Morpheus](/platform/credentials/morpheus)         |
| SSH Key            | Server access on self-managed clusters            | `ankra credentials <provider> ssh-key` (Hetzner, OVH, DigitalOcean, UpCloud) | [SSH Key](/platform/credentials/ssh-key)           |

***

## Using credentials

Credentials are selected by name where they're needed:

* **Registries**: when adding a Helm registry, pick the [registry credential](/platform/credentials/registry) from the dropdown.
* **Clusters**: when provisioning or importing a cluster, pick the matching cloud credential (and an [SSH key](/platform/credentials/ssh-key) for self-managed clusters).
* **GitOps**: the [Git connection](/platform/credentials/git) is used automatically when syncing configuration.

***

## Managing credentials

### View credentials

Go to **Credentials** to see all stored credentials as cards - each card shows the provider, credential type, health, and when it was last updated. Filter by name or provider, sort, and select multiple cards for bulk deletion.

Opening a credential shows its identity - provider, availability, whether it is in use, and when it was created - with the rest organised into tabs:

* **Overview** - the identity fields the credential authenticates with (secret values stay masked or in the platform's secret store) and a **Verify connection** check that probes the provider API with the stored credential.
* **Capacity** - the live capacity and usage report, for cloud providers (see below).
* **Used by** - the clusters running on this credential and any operations currently holding it.
* **Rotation** - in-place secret rotation, for providers that support it.

### Capacity and usage

Open any cloud provider credential and switch to the **Capacity** tab for a live capacity report read from the provider with that credential:

* **Hetzner** shows project usage: servers with their combined vCPUs, memory, and disk, volumes, load balancers, floating and primary IPs, networks, firewalls, and SSH keys. Hetzner does not expose project limits through its API, so the view shows usage only.
* **Proxmox VE** shows the total resources of the cluster behind the credential: each node with used and total CPU and memory, storage pools (shared pools counted once), and how many guests are running with the vCPUs and memory allocated to them.
* **UpCloud** shows the account's resource limits (CPU cores, memory, storage, IPs, networks, load balancers) as usage bars, plus remaining credits.
* **DigitalOcean** shows account limits (droplets, floating and reserved IPs) with usage against them, droplet resource sums, volumes, and load balancers.
* **OVHcloud** shows the project's per-region quotas: vCPUs, instances, memory, and volume storage as usage bars per region and in total, plus volume and load balancer counts.
* **Scaleway** shows project usage swept across zones: servers with real vCPU and memory sums, storage, and load balancers. Scaleway does not expose quota headroom through its APIs, so the view shows usage only.
* **HPE Morpheus** shows each cloud on the appliance with used and total memory and storage plus CPU load, and the appliance's instance and host counts.
* **Azure** shows the subscription's virtual machine and AKS cluster counts, with regional vCPU and VM quota bars for the regions currently in use.

The report is read from the provider API when you open the credential, so it reflects everything in the account, including resources created outside Ankra.

### Update a credential

Identity fields are fixed - a credential always points at the same account or infrastructure. What changes is the secret material, and that rotates in place:

1. Click on the credential name
2. Open the **Rotation** tab
3. Enter the new secret and click **Verify & rotate**

The new secret is verified against the provider before anything is saved, so a failed rotation never breaks the working credential.

<Note>
  Rotating a credential automatically applies to everything using it. No need to reconfigure registries or clusters.
</Note>

### Delete a credential

1. Go to **Credentials**
2. Click the menu (⋮) next to the credential
3. Select **Delete**

<Warning>
  Deleting a credential will break authentication for anything using it. Update those integrations first.
</Warning>

### AI and MCP access

Ankra's AI and MCP clients can list and inspect credentials (secret fields are always redacted), validate names, delete unused credentials, and plan and apply a GitHub credential rotation - but they can never **create** a credential, because that would mean passing the secret itself to the AI, which the platform refuses. See the [MCP Tool Reference](/platform/mcp-tools#credentials).

***

## Security

### Storage

Credentials are stored securely in a dedicated secret store (HashiCorp Vault or OpenBao):

* Encrypted at rest
* Access controlled per organisation
* Audit logging for all access

### Best practices

<CardGroup cols={2}>
  <Card title="Use Tokens, Not Passwords" icon="key">
    Prefer access tokens over account passwords. Tokens can be scoped and revoked independently.
  </Card>

  <Card title="Minimum Permissions" icon="shield">
    Grant only the permissions needed. For chart sync and cost, read-only access is enough.
  </Card>

  <Card title="Rotate Regularly" icon="rotate">
    Rotate credentials periodically, especially for production.
  </Card>

  <Card title="Separate by Environment" icon="layer-group">
    Use different credentials for dev, staging, and production.
  </Card>
</CardGroup>

***

## Troubleshooting

### Authentication errors

| Error              | Cause                    | Solution                            |
| ------------------ | ------------------------ | ----------------------------------- |
| 401 Unauthorized   | Invalid credentials      | Verify username and password/token  |
| 403 Forbidden      | Insufficient permissions | Check the token has required scopes |
| Token expired      | Temporary tokens (ECR)   | Refresh the token                   |
| Connection refused | Network issue            | Check firewall and network access   |

For provider-specific troubleshooting, see the individual credential pages (for example [GCP](/platform/credentials/gcp)).

***

## API access

Manage credentials via the Ankra API:

```python theme={null}
import requests

headers = {"Authorization": f"Bearer {TOKEN}"}

# List credentials
response = requests.get(
    "https://platform.ankra.app/api/v1/credentials",
    headers=headers
)

# Create credential
response = requests.post(
    "https://platform.ankra.app/api/v1/credentials",
    headers=headers,
    json={
        "name": "my-registry-auth",
        "provider": "registry",
        "username": "myuser",
        "password": "mytoken"
    }
)
```

See the [API Reference](/api-reference/introduction) for complete documentation.