Morpheus API Credentials

Store a Morpheus appliance URL and access token in Ankra to provision and manage self-managed Morpheus clusters.

Morpheus clusters are in closed beta. The workflow is still evolving and access is limited. Contact us to request access before relying on it.

Morpheus API credentials store the Morpheus appliance URL and a long-lived API access token, used to provision and manage self-managed Morpheus clusters. The token is validated when you save it - Ankra calls the appliance’s identity endpoint (GET /api/whoami). For appliances behind an SSH jumphost, the direct probe is skipped and the connection is tested during cluster provisioning instead.

Morpheus credentials are managed from the portal or API - there is no ankra credentials morpheus CLI command.

What Ankra Accesses

Ankra drives the Morpheus appliance API with your token:

Resource	Operations	Why it’s used
Instances	create, read, start/stop, delete	The cluster’s nodes and bastion, provisioned as Morpheus instances
Networks	read	Placement options for the cluster’s instances
Groups, clouds, service plans, instance types	read	The provisioning targets and sizes offered in the cluster wizard

There is no finer token scoping on the Morpheus side: the token acts as its user, so that user must be able to see the target group and cloud and provision instances into them.

Creating a Morpheus API Credential

1. Get a Morpheus access token

   In the Morpheus UI, go to User Settings → API Access and create a long-lived access token for a user that can provision into the target group and cloud.

2. Add to Ankra (UI)

   Go to Credentials → Add → Morpheus, then provide:

   • Name: a unique identifier - lowercase letters and numbers only, cannot start with a hyphen (e.g. morpheus-lab)
   • Appliance URL: the HTTPS address of your Morpheus appliance (e.g. https://morpheus.example.com)
   • Access Token: the token from the previous step
   • Skip TLS certificate verification: enable only for self-signed certificates on trusted networks

   For appliances that are not directly reachable, expand SSH jumphost and set the jumphost host and private key (port defaults to 22, username to root).

   Click Test connection, then save.

For Morpheus clusters you also need an SSH key credential, created from the portal or generated via another provider’s CLI.

The access token can be rotated later from the credential’s page. The appliance URL is fixed - to point at a different appliance, create a new credential.

Troubleshooting Morpheus Credentials

The table below covers the Test connection result in the Ankra UI:

Test connection result	Cause	Solution
HPE Morpheus rejected the API token.	The token is invalid, expired, or revoked	Create a new access token in the Morpheus UI and re-paste it
Could not reach the HPE Morpheus API.	Wrong appliance URL, the appliance is not reachable from Ankra, or a TLS failure on a self-signed certificate	Check the URL; for private appliances configure the SSH jumphost; for self-signed certificates enable Skip TLS certificate verification
HPE Morpheus returned HTTP <code>.	Unexpected appliance-side response	Retry; check the appliance’s health if it persists
Morpheus credential with jumphost accepted; connection test runs during cluster provisioning.	Not an error - jumphost credentials skip the direct probe	Nothing to do; the tunnel is exercised when a cluster is provisioned

Test connection verifies the token identifies a user, not what that user may do. If the credential saves fine but provisioning fails, the token’s user cannot see or provision into the selected group and cloud - fix the user’s Morpheus role, or create a token for a user that can and rotate it in on the credential’s page.