> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials

> Securely manage authentication credentials for registries, Git providers, and cloud platforms.

Credentials in Ankra store authentication information for connecting to external services - Helm and container registries, Git providers, and cloud platforms used for cluster provisioning and cost estimation. Credentials are stored securely in a Vault-compatible secret store (HashiCorp Vault or OpenBao) and referenced by name when configuring integrations and clusters.

## Choose a credential type

<CardGroup cols={2}>
  <Card title="Registry" icon="box" href="/platform/credentials/registry">
    Helm chart and container registries (HTTP and OCI).
  </Card>

  <Card title="Git" icon="code-branch" href="/platform/credentials/git">
    GitHub, GitLab, and other Git providers for GitOps.
  </Card>

  <Card title="Hetzner" icon="cloud" href="/platform/credentials/hetzner">
    Hetzner Cloud API token for cluster provisioning.
  </Card>

  <Card title="OVH" icon="cloud" href="/platform/credentials/ovh">
    OVHcloud application keys and Public Cloud project.
  </Card>

  <Card title="DigitalOcean" icon="digital-ocean" href="/platform/credentials/digitalocean">
    DigitalOcean personal access token for droplets and DOKS.
  </Card>

  <Card title="UpCloud" icon="cloud" href="/platform/credentials/upcloud">
    UpCloud subaccount API access for servers and UKS.
  </Card>

  <Card title="AWS" icon="aws" href="/platform/credentials/aws">
    IAM role or access keys for cost, inventory, and EKS.
  </Card>

  <Card title="Google Cloud (GCP)" icon="google" href="/platform/credentials/gcp">
    Read-only service account for cost, discovery, and GKE.
  </Card>

  <Card title="Azure" icon="microsoft" href="/platform/credentials/azure">
    Service principal for provisioning AKS (early access).
  </Card>

  <Card title="Proxmox VE" icon="server" href="/platform/credentials/proxmox">
    Proxmox API URL and token for self-managed clusters.
  </Card>

  <Card title="Morpheus" icon="server" href="/platform/credentials/morpheus">
    Morpheus appliance URL and access token.
  </Card>

  <Card title="SSH Key" icon="lock" href="/platform/credentials/ssh-key">
    SSH keys for server access on self-managed clusters.
  </Card>
</CardGroup>

## Compare credential types

| Credential         | Used for                                          | CLI command                                                                  | Guide                                              |
| ------------------ | ------------------------------------------------- | ---------------------------------------------------------------------------- | -------------------------------------------------- |
| Registry           | Sync Helm charts / images from private registries | — (UI/API)                                                                   | [Registry](/platform/credentials/registry)         |
| Git                | GitOps configuration sync                         | — (via GitHub App)                                                           | [Git](/platform/credentials/git)                   |
| Hetzner            | Provision Hetzner clusters                        | `ankra credentials hetzner`                                                  | [Hetzner](/platform/credentials/hetzner)           |
| OVH                | Provision OVH clusters and OVHcloud MKS           | `ankra credentials ovh`                                                      | [OVH](/platform/credentials/ovh)                   |
| DigitalOcean       | Provision droplet clusters and DOKS               | `ankra credentials digitalocean`                                             | [DigitalOcean](/platform/credentials/digitalocean) |
| UpCloud            | Provision UpCloud clusters and UKS                | `ankra credentials upcloud`                                                  | [UpCloud](/platform/credentials/upcloud)           |
| AWS                | Cost, inventory, and EKS                          | — (UI/API)                                                                   | [AWS](/platform/credentials/aws)                   |
| Google Cloud (GCP) | Cost, discovery, and GKE                          | — (UI/API)                                                                   | [GCP](/platform/credentials/gcp)                   |
| Azure              | Provision AKS (early access - via support)        | —                                                                            | [Azure](/platform/credentials/azure)               |
| Proxmox VE         | Provision self-managed Proxmox clusters           | — (UI/API)                                                                   | [Proxmox VE](/platform/credentials/proxmox)        |
| Morpheus           | Provision self-managed Morpheus clusters          | — (UI/API)                                                                   | [Morpheus](/platform/credentials/morpheus)         |
| SSH Key            | Server access on self-managed clusters            | `ankra credentials <provider> ssh-key` (Hetzner, OVH, DigitalOcean, UpCloud) | [SSH Key](/platform/credentials/ssh-key)           |

***

## Using credentials

Credentials are selected by name where they're needed:

* **Registries**: when adding a Helm registry, pick the [registry credential](/platform/credentials/registry) from the dropdown.
* **Clusters**: when provisioning or importing a cluster, pick the matching cloud credential (and an [SSH key](/platform/credentials/ssh-key) for self-managed clusters).
* **GitOps**: the [Git connection](/platform/credentials/git) is used automatically when syncing configuration.

***

## Managing credentials

### View credentials

Go to **Credentials** to see all stored credentials:

* Name and type
* Creation date
* Associated registries and clusters (if any)

### Update a credential

1. Click on the credential name
2. Update the fields
3. Click **Save**

<Note>
  Updating a credential automatically applies to everything using it. No need to reconfigure registries or clusters.
</Note>

### Delete a credential

1. Go to **Credentials**
2. Click the menu (⋮) next to the credential
3. Select **Delete**

<Warning>
  Deleting a credential will break authentication for anything using it. Update those integrations first.
</Warning>

### AI and MCP access

Ankra's AI and MCP clients can list and inspect credentials (secret fields are always redacted), validate names, delete unused credentials, and plan and apply a GitHub credential rotation - but they can never **create** a credential, because that would mean passing the secret itself to the AI, which the platform refuses. See the [MCP Tool Reference](/platform/mcp-tools#credentials).

***

## Security

### Storage

Credentials are stored securely in a dedicated secret store (HashiCorp Vault or OpenBao):

* Encrypted at rest
* Access controlled per organisation
* Audit logging for all access

### Best practices

<CardGroup cols={2}>
  <Card title="Use Tokens, Not Passwords" icon="key">
    Prefer access tokens over account passwords. Tokens can be scoped and revoked independently.
  </Card>

  <Card title="Minimum Permissions" icon="shield">
    Grant only the permissions needed. For chart sync and cost, read-only access is enough.
  </Card>

  <Card title="Rotate Regularly" icon="rotate">
    Rotate credentials periodically, especially for production.
  </Card>

  <Card title="Separate by Environment" icon="layer-group">
    Use different credentials for dev, staging, and production.
  </Card>
</CardGroup>

***

## Troubleshooting

### Authentication errors

| Error              | Cause                    | Solution                            |
| ------------------ | ------------------------ | ----------------------------------- |
| 401 Unauthorized   | Invalid credentials      | Verify username and password/token  |
| 403 Forbidden      | Insufficient permissions | Check the token has required scopes |
| Token expired      | Temporary tokens (ECR)   | Refresh the token                   |
| Connection refused | Network issue            | Check firewall and network access   |

For provider-specific troubleshooting, see the individual credential pages (for example [GCP](/platform/credentials/gcp)).

***

## API access

Manage credentials via the Ankra API:

```python theme={null}
import requests

headers = {"Authorization": f"Bearer {TOKEN}"}

# List credentials
response = requests.get(
    "https://platform.ankra.app/api/v1/credentials",
    headers=headers
)

# Create credential
response = requests.post(
    "https://platform.ankra.app/api/v1/credentials",
    headers=headers,
    json={
        "name": "my-registry-auth",
        "provider": "registry",
        "username": "myuser",
        "password": "mytoken"
    }
)
```

See the [API Reference](/api-reference/introduction) for complete documentation.