Create OVHcloud API keys

Use this guide if you need to connect InfraNest to OVHcloud by creating your own API keys for domains, DNS or VPS servers.

Overview

• You only need this if Connect with OVHcloud isn't offered on the connection screen. When it is, use that instead — it's quicker and there's nothing to copy or rotate.
• OVHcloud gives you three values at once: an Application Key, an Application Secret and a Consumer Key. All three go into InfraNest.

NoteSetting up Connect with OVHcloud itself is an administrator job, not something a customer does — see the section at the end of this article. A service account is not the right thing for it.

Create the keys

1. Go to the token page for your region — this must match the region you picked in InfraNest:

   • Europe — eu.api.ovh.com/createToken
   • Canada / Asia-Pacific — ca.api.ovh.com/createToken
   • United States — api.us.ovhcloud.com/createToken

2. Sign in with your OVHcloud account.

3. Fill in a Script name (for example InfraNest) and a description, so you recognise it later.

4. Set Validity to Unlimited, unless you want to rotate the keys yourself on a schedule.

5. Under Rights, add one line per row below. The link InfraNest gives you opens this page with every row already filled in, so this list is here for checking rather than typing.

   Domains and DNS

   • GET /domain — List your domains
   • GET /domain/* — Read a domain's details, nameservers, DNS zones
   • POST /domain/* — Change nameservers, contacts, DNSSEC
   • PUT /domain/* — Transfer lock, auto-renew, DNS records
   • DELETE /domain/* — Delete DNS records

   Buying and pricing domains

   • POST /order/cart — Start a price or availability lookup
   • POST /order/cart/* — Register or transfer a domain
   • GET /order/cart/* — Read the prices back
   • DELETE /order/cart/* — Tidy the lookup away again

   Servers (only if you run VPS at OVHcloud)

   • GET /vps — List your VPS
   • GET /vps/* — Read a VPS, its IPs and its backups
   • POST /vps/* — Start, stop, reboot, reinstall, take a snapshot
   • PUT /vps/* — Rename it, edit reverse DNS
   • DELETE /vps/* — Delete a snapshot

   Nothing outside these three areas is needed — InfraNest never asks for access to your account itself.

   /domain and /domain/* are two separate rules — the * covers everything below /domain, but not /domain itself. Miss the first row and listing your domains fails with "This call has not been granted" while everything else works. The same applies to /order/cart and /vps, which is why each of them appears twice above.

   TipAlready have a key? Keys created before domain registration and VPS support were added don't have the POST /order/cart/* or DELETE /vps/* rows. Everything else keeps working, but buying a domain or deleting a snapshot fails with "This call has not been granted". Create a fresh set of keys from the link above and paste them in — nothing is lost, and no domain is ever half-bought by this.

6. Select Create keys.

Copy them into InfraNest

1. OVHcloud now shows the three values once. Copy each into the matching field on the InfraNest connection screen:
   • Application Key → Application Key
   • Application Secret → Application Secret
   • Consumer Key → Consumer Key
2. If you close the page before copying them, you can't get them back — create a new set and delete the old one.

Good to know

• The rights you grant are the rights InfraNest has. Only the /domain/* paths are needed for DNS and domains. Don't grant /*.
• Keys are per region. Keys made on the European page won't work if the connection is set to United States.
• To revoke access, go to your OVHcloud account under API keys and delete the entry. The connection in InfraNest will start reporting errors, which is what you want.

Troubleshooting

• "Authentication failed" — check the region matches where you created the keys, and that all three values were pasted without stray spaces.
• Reads work but changes fail — you likely only granted GET. Add POST, PUT and DELETE on /domain/*, or create a new set of keys with all four.

For administrators: enabling Connect with OVHcloud

This part is for whoever runs the InfraNest platform, and it's the step OVHcloud's own documentation makes easy to get wrong.

A service account will not work. OVHcloud's control panel offers service accounts, which use the CLIENT_CREDENTIALS flow — they authenticate as themselves, machine-to-machine. That's why a service account gives you an id and a password but no field for a callback URL, and why sending a user to it shows an "You are logged in as…" page with a Customer Center button instead of an Allow button. There is nothing to approve, because nobody is being asked for permission.

What you need is an OAuth2 client using the AUTHORIZATION_CODE flow, which the control panel does not create — it has to be made through the API:

1. Open the API console for your region — eu.api.ovh.com/console (or the ca / us equivalent).

2. Find POST /me/api/oauth2/client and select Authenticate (a browser login; no keys needed).

3. Send:

   {
     "name": "InfraNest",
     "description": "InfraNest one-click connect",
     "flow": "AUTHORIZATION_CODE",
     "callbackUrls": ["https://your-infranest-url/api/provider-oauth/ovh/callback"]
   }
   

   The callback URL must match exactly what Admin Panel → Integrations → OVHcloud shows; there's a Copy button next to it.

4. The response contains a clientId and a clientSecret. The secret is shown once.

5. Paste both into the slot for your region in Admin Panel → Integrations → OVHcloud.

Each region is a separate platform, so it needs its own client created on its own console. Regions you leave blank simply keep using the API-key method above.

Nothing else is needed on the customer's side. Approving the connection is enough — they don't have to set up an access policy in OVHcloud first, which is the whole reason this is quicker than creating keys.

WarningIf a connection succeeds but every call then fails with "User not granted for this request", the connection was made before this was fixed. Permissions are decided at the moment someone approves the connection, so an older one can't be repaired in place — disconnect it and connect again.