> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect OVHcloud with API Key – StackOne Hub

> Link a OVHcloud account in the StackOne Hub using API Key. End-user guide to authorize the integration and start using OVHcloud actions.

> [!WARNING]
>
> Creating the user and its policy needs the account holder or a user in a group with the Administrator role, which includes user management. The token acts with the rights of its local user, so give that user only the policy below.

## Find your Region

The **Region** decides which OVHcloud API endpoint StackOne calls for your account.

<ul>
  <li>**Europe** is the OVHcloud Europe API. It serves the CZ, DE, ES, EU, FI, FR, GB, IE, IT, LT, MA, NL, PL, PT, SN and TN subsidiaries, so Morocco, Senegal and Tunisia use **Europe** too.</li>
  <li>**Canada, Asia-Pacific and rest of world** is the OVHcloud North-America API. It serves the ASIA, AU, CA, IN, QC, SG, WE and WS subsidiaries.</li>
  <li>**United States** is the OVHcloud US API, for the US subsidiary.</li>
  <li>Choose the region that matches the location of your account.</li>
  <li>Select it in the **Region** field in StackOne Hub.</li>
</ul>

## Create a local user for the connection

A Personal Access Token belongs to one local user and has only the rights that user's IAM policies give it, so create a dedicated user for StackOne.

**1. Sign in to OVHcloud**

Sign in to the OVHcloud Control Panel as the account holder or as a user in a group with the **Administrator** role.

<ul>
  <li>Navigate to **Identity, Security & Operations** > **Identities** > **Local users**.</li>
</ul>

**2. Create a group with no default access**

Open the **User groups** tab and click **Declare a group**.

<ul>
  <li>Enter a group name such as `stackone`, choose the role **None**, then click **Confirm**.</li>
  <li>A group with the role **None** gives no access without an IAM policy, so the policy below is the only access the StackOne user has.</li>
</ul>

**3. Add the user**

Go back to **Local users**, click **Add user**, complete the form, then click **Confirm**.

<ul>
  <li>**ID**: `stackone-integration`</li>
  <li>Enter an **Email** and a **Password** for the user.</li>
  <li>**Group**: the group you declared in the previous step</li>
  <li>**Description**: `StackOne access review`</li>
  <li>The default **UNPRIVILEGED (Read-Only)** group also works with the policy below, but it gives the user read access to every section of the Control Panel, not only what the policy allows.</li>
  <li>OVHcloud builds the user's login from your account ID and the ID, for example `1234-567-89/stackone-integration`.</li>
</ul>

## Allow the user to read identities

The token can call only what the IAM policies of its user allow. Create one policy that lists the read actions the connection uses.

**1. Open the policies**

Navigate to **Identity, Security & Operations** > **Policies** and click **Create a policy**.

**2. Choose who and what the policy covers**

Complete the form for the policy.

<ul>
  <li>**Policy name**: `stackone-access-review`. The name must be unique and must not contain spaces.</li>
  <li>Under **Identities**, select the new user.</li>
  <li>Under **Product types**, select **OVHcloud customer account**. Under **Resources**, add your account.</li>
</ul>

**3. Add the actions**

Under **Actions**, add these actions manually. OVHcloud accepts an action name typed in full.

<ul>
  <li>Users, groups, roles and the connection test: `account:apiovh:me/get`, `account:apiovh:me/identity/user/get`, `account:apiovh:me/identity/group/get` and `account:apiovh:iam/policy/get`.</li>
  <li>Group members, identity provider, service accounts and token names: `account:apiovh:me/identity/group/user/get`, `account:apiovh:me/identity/provider/get`, `account:apiovh:me/api/oauth2/client/get` and `account:apiovh:me/identity/user/token/get`.</li>
  <li>Only for the actions that change users and groups: `account:apiovh:me/identity/group/user/add` and `account:apiovh:me/identity/group/user/remove` add and remove group members, and `account:apiovh:me/identity/user/disable` and `account:apiovh:me/identity/user/enable` disable and enable users. A user added to a group gets the group's role, so with `account:apiovh:me/identity/group/user/add` the token can move any local user, its own included, into the **ADMIN (Administrator)** group. Leave these four out to keep the connection read-only.</li>
  <li>The managed permission group **Global read-only** also covers every read action, but it reads all OVHcloud products and also allows `account:apiovh:me/changePassword` and the two-factor actions under `account:apiovh:me/accessRestriction`.</li>
</ul>

## Create the token

Create a Personal Access Token for the new user and copy it.

**1. Open the token list**

Navigate to **Identity, Security & Operations** > **Identities** > **Local users**, click **…** at the end of the user's row, then select **Manage tokens**.

**2. Add a token**

On the **Manage Tokens** page, click **Add a token**, complete the form, then click **Create**.

<ul>
  <li>**Name**: `stackone-access-review`</li>
  <li>Enter a **Description** of how the token is used.</li>
  <li>For a token that does not expire, turn off the **Expiry date** toggle. Otherwise set a duration or a fixed date. When the token expires, the connection fails until you paste a new token into StackOne Hub.</li>
</ul>

**3. Copy the token**

Copy the token value and store it securely for use later.

<ul>
  <li>The token is shown once and cannot be retrieved later.</li>
  <li>Paste it into the **Personal Access Token** field in StackOne Hub.</li>
</ul>

## Know what a smaller grant breaks

Without any one of the first four actions the connection test is refused, `account:apiovh:iam/policy/get` included.

<ul>
  <li>Without the group member, identity provider, service account or token name actions, only the matching action is refused.</li>
  <li>Without the four change actions, adding and removing group members and disabling and enabling users are refused.</li>
</ul>

## Revoke the token

To stop StackOne from reading your account, delete the token. This blocks further API calls immediately.

<ul>
  <li>On the **Manage Tokens** page, click **…** at the end of the token row, then select **Delete**.</li>
  <li>Click **Delete** in the confirmation window.</li>
</ul>

## Linking the Account from the Hub

**1. Navigate to the Hub**

Use one of the three [Linking Account Methods](https://docs.stackone.com/connect/managing-connectors/linking-accounts.md) to access the Hub.

**2. Fill out the fields**

Fill out the following fields using details from your provider:

<ul>
  <li>**Region**</li>
  <li>**Personal Access Token**</li>
</ul>

**3. Connect**

<ul>
  <li>Click **Connect**</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup</li>
</ul>

If the account linking is successful, you will see the newly linked account on your [Accounts](https://app.stackone.com/accounts) page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.