Skip to main content
Creating the user and its policy needs the account holder or a user in a group with the Administrator role, which includes user management. The token acts with the rights of its local user, so give that user only the policy below.

​
Find your Region

The Region decides which OVHcloud API endpoint StackOne calls for your account.

  • Europe is the OVHcloud Europe API. It serves the CZ, DE, ES, EU, FI, FR, GB, IE, IT, LT, MA, NL, PL, PT, SN and TN subsidiaries, so Morocco, Senegal and Tunisia use Europe too.
  • Canada, Asia-Pacific and rest of world is the OVHcloud North-America API. It serves the ASIA, AU, CA, IN, QC, SG, WE and WS subsidiaries.
  • United States is the OVHcloud US API, for the US subsidiary.
  • Choose the region that matches the location of your account.
  • Select it in the Region field in StackOne Hub.

​
Create a local user for the connection

A Personal Access Token belongs to one local user and has only the rights that user’s IAM policies give it, so create a dedicated user for StackOne.

1

Sign in to OVHcloud

Sign in to the OVHcloud Control Panel as the account holder or as a user in a group with the Administrator role.

  • Navigate to Identity, Security & Operations > Identities > Local users.
2

Create a group with no default access

Open the User groups tab and click Declare a group.

  • Enter a group name such as stackone, choose the role None, then click Confirm.
  • A group with the role None gives no access without an IAM policy, so the policy below is the only access the StackOne user has.
3

Add the user

Go back to Local users, click Add user, complete the form, then click Confirm.

  • ID: stackone-integration
  • Enter an Email and a Password for the user.
  • Group: the group you declared in the previous step
  • Description: StackOne access review
  • The default UNPRIVILEGED (Read-Only) group also works with the policy below, but it gives the user read access to every section of the Control Panel, not only what the policy allows.
  • OVHcloud builds the user’s login from your account ID and the ID, for example 1234-567-89/stackone-integration.

​
Allow the user to read identities

The token can call only what the IAM policies of its user allow. Create one policy that lists the read actions the connection uses.

1

Open the policies

Navigate to Identity, Security & Operations > Policies and click Create a policy.

2

Choose who and what the policy covers

Complete the form for the policy.

  • Policy name: stackone-access-review. The name must be unique and must not contain spaces.
  • Under Identities, select the new user.
  • Under Product types, select OVHcloud customer account. Under Resources, add your account.
3

Add the actions

Under Actions, add these actions manually. OVHcloud accepts an action name typed in full.

  • Users, groups, roles and the connection test: account:apiovh:me/get, account:apiovh:me/identity/user/get, account:apiovh:me/identity/group/get and account:apiovh:iam/policy/get.
  • Group members, identity provider, service accounts and token names: account:apiovh:me/identity/group/user/get, account:apiovh:me/identity/provider/get, account:apiovh:me/api/oauth2/client/get and account:apiovh:me/identity/user/token/get.
  • Only for the actions that change users and groups: account:apiovh:me/identity/group/user/add and account:apiovh:me/identity/group/user/remove add and remove group members, and account:apiovh:me/identity/user/disable and account:apiovh:me/identity/user/enable disable and enable users. A user added to a group gets the group’s role, so with account:apiovh:me/identity/group/user/add the token can move any local user, its own included, into the ADMIN (Administrator) group. Leave these four out to keep the connection read-only.
  • The managed permission group Global read-only also covers every read action, but it reads all OVHcloud products and also allows account:apiovh:me/changePassword and the two-factor actions under account:apiovh:me/accessRestriction.

​
Create the token

Create a Personal Access Token for the new user and copy it.

1

Open the token list

Navigate to Identity, Security & Operations > Identities > Local users, click … at the end of the user’s row, then select Manage tokens.

2

Add a token

On the Manage Tokens page, click Add a token, complete the form, then click Create.

  • Name: stackone-access-review
  • Enter a Description of how the token is used.
  • For a token that does not expire, turn off the Expiry date toggle. Otherwise set a duration or a fixed date. When the token expires, the connection fails until you paste a new token into StackOne Hub.
3

Copy the token

Copy the token value and store it securely for use later.

  • The token is shown once and cannot be retrieved later.
  • Paste it into the Personal Access Token field in StackOne Hub.

​
Know what a smaller grant breaks

Without any one of the first four actions the connection test is refused, account:apiovh:iam/policy/get included.

  • Without the group member, identity provider, service account or token name actions, only the matching action is refused.
  • Without the four change actions, adding and removing group members and disabling and enabling users are refused.

​
Revoke the token

To stop StackOne from reading your account, delete the token. This blocks further API calls immediately.

  • On the Manage Tokens page, click … at the end of the token row, then select Delete.
  • Click Delete in the confirmation window.

​
Linking the Account from the Hub

1

Navigate to the Hub

Use one of the three Linking Account Methods to access the Hub.
2

Fill out the fields

Fill out the following fields using details from your provider:
  • Region
  • Personal Access Token
3

Connect

  • Click Connect
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup

If the account linking is successful, you will see the newly linked account on your Accounts page.