Cloud tokens
Coolify uses cloud tokens to connect to supported cloud providers. A cloud token belongs to the active Coolify team and can be used when creating or managing a server in that provider account.
Only team administrators and owners can manage cloud tokens. Coolify encrypts the token value in its database and does not display the saved value again.
Create a dedicated provider token for Coolify, grant only the access it needs, and store the original value in a secret manager. Revoke and replace the token immediately if it is exposed.
Create a provider token
Choose the provider account where Coolify will create and manage servers. Most readers need only one of these procedures.
Hetzner tokens belong to one project. Create the token in the project where Coolify should manage servers.
Open the Hetzner project
Open the Hetzner Cloud Console, then select the required project.
Open API tokens
Select Security in the project sidebar, open API Tokens, then select Generate API Token.
Configure the token
Enter a description such as coolify-shadowarcanist, then select Read & Write.
Coolify needs write access to create and delete servers, upload SSH keys, control server power, and optionally enable Hetzner backups. A Read token may pass the initial validation but cannot perform these actions.
Generate and copy the token
Select Generate API Token, copy the complete value, and store it securely. Hetzner does not show the token again after you close the dialog.
Add the token to Coolify
Open Cloud Tokens
Open Keys & Tokens in the Coolify sidebar, then select Cloud Tokens.
Choose the provider
Select + Add, then choose Hetzner, DigitalOcean, or Vultr.
Enter the token details
Complete the form:
- Token Name: Enter a name that identifies the provider account or environment, such as
shadowarcanist-production. - Description: Optionally record the project, team, account, or intended use.
- API Token: Paste the complete token or API key copied from the provider.
Select Validate & Add Token.
Confirm the token was added
After validation succeeds, Coolify closes the form and displays the new token on the Cloud Provider Tokens page.
Coolify validates a Hetzner token by listing servers and validates DigitalOcean and Vultr tokens through their account endpoints. A successful result confirms that the provider accepts the credential, but it does not prove that every permission required to create or manage a server is available.
Manage a cloud token
Open Keys & Tokens > Cloud Tokens, then select a token.
- Change Name or Description, then select Save.
- Select Validate to check whether the provider still accepts the saved credential.
- Select Delete to remove an unused token.
The provider and creation date are read-only. Coolify does not show or replace the saved secret on this page. To rotate a credential, create a replacement at the provider, add it as a new cloud token, and move every dependent server to the replacement before revoking the previous credential.
Coolify blocks deletion while one or more servers still use the token. Do not revoke the credential at the provider until those servers have been moved to another token or are no longer managed through that provider connection.