OVH API Credentials

Store OVHcloud application keys, a consumer key with cloud-project rights, and a Public Cloud project in Ankra to provision OVH clusters and OVHcloud MKS.

OVH API credentials store an OVHcloud application key, application secret, consumer key, and Public Cloud project ID, used to provision and manage self-managed OVH clusters and OVHcloud Managed Kubernetes (MKS). The credentials are validated when you save them - Ankra makes a signed read-only call to the OVH API (GET /cloud/project/{project_id}/region), so invalid keys or a consumer key without cloud-project rights are refused immediately.

What Ankra Accesses

All calls are scoped to your Public Cloud project (/cloud/project/{project_id}/...) on the OVH EU API endpoint (eu.api.ovh.com). One credential covers both cluster types. For self-managed OVH clusters, Ankra provisions the infrastructure directly:

Resource	Operations	Why it’s used
Instances	create, read, power actions, delete	The cluster’s nodes and bastion
SSH keys	upload, read, delete	Install your SSH key credential on the instances it creates
Private networks (vRack) and subnets	create, read, delete	The cluster’s private network
Cloud gateways	create, read, attach, delete	Outbound internet access (egress NAT) for private nodes
Flavors, images, public network	read	Placement options in the cluster wizard
Operations	read	Poll long-running OVH operations to completion

For OVHcloud MKS, Ankra uses the managed Kubernetes API instead:

Resource	Operations	Why it’s used
Kubernetes clusters (/kube)	create, read, delete	MKS cluster lifecycle
Node pools	create, read, update, delete	Scale and manage the cluster’s node pools
Kubeconfig	read	Connect Ankra’s agent to the cluster
Regions, versions, flavors	read	Available regions, Kubernetes versions, and node sizes in the wizard

Creating OVH API Credentials

1. Generate OVH API credentials

   1. Go to https://api.ovh.com/createToken/
   2. Log in with your OVH account
   3. Set the following access rules - these are exactly what the validation checks and the tables above use:
      • GET, POST, PUT, DELETE on /cloud/project/*
      • GET on /cloud/project
   4. Click Create Keys
   5. Save the Application Key, Application Secret, and Consumer Key
2. Get your project ID

   1. Log in to the OVH Control Panel
   2. Go to Public Cloud → select your project
   3. Copy the Project ID from the dashboard URL or project settings
3. Add to Ankra (UI)

   Go to Credentials → Add → OVH, then provide:

   • Name: a unique identifier - lowercase letters and numbers only, cannot start with a hyphen (e.g. ovh-prod)
   • Application Key, Application Secret, Consumer Key: the keys from step 1
   • Project ID: from step 2

   Click Test connection to verify the keys against the OVH API, then save.

4. Or via CLI

   ankra credentials ovh create --name my-ovh-cred --project-id <project-id>
   # You will be securely prompted for application key, application secret, and consumer key
   

For self-managed OVH clusters you also need an SSH key credential.

The application key, application secret, and consumer key can be rotated later from the credential’s page. The project ID is fixed - to target a different Public Cloud project, create a new credential.

Listing OVH Credentials

CLI

ankra credentials ovh list

Troubleshooting OVH Credentials

The table below covers the Test connection result in the Ankra UI:

Test connection result	Cause	Solution
OVH rejected the supplied keys.	The application key, application secret, or consumer key is invalid or revoked	Regenerate the keys at api.ovh.com/createToken and re-enter all three
OVH accepted the keys but the consumer key lacks the required permissions.	The consumer key’s access rules don’t cover cloud-project resources	Regenerate with GET, POST, PUT, DELETE on /cloud/project/* and GET on /cloud/project
Could not reach the OVH API.	Network or connectivity issue	Retry; ensure outbound access to eu.api.ovh.com
OVH returned HTTP <code>.	Unexpected OVH-side response, or a wrong project ID	Check the Project ID matches your Public Cloud project exactly, then retry

Saving without testing runs the same validation and reports the same causes - for a permissions failure the save error spells out the exact access rules to regenerate with.

Consumer keys can also expire if you set a validity period at creation. If a credential that used to work starts failing with rejected keys, regenerate at api.ovh.com/createToken (with unlimited validity if your policy allows) and rotate the three keys in on the credential’s page.