> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials

> Securely manage authentication credentials for registries, Git providers, and cloud platforms.

Credentials in Ankra store authentication information for connecting to external services - Helm and container registries, Git providers, and cloud platforms used for cluster provisioning and cost estimation. Credentials are stored securely in HashiCorp Vault and referenced by name when configuring integrations and clusters.

## Choose a credential type

<CardGroup cols={2}>
  <Card title="Registry" icon="box" href="/platform/credentials/registry">
    Helm chart and container registries (HTTP and OCI).
  </Card>

  <Card title="Git" icon="code-branch" href="/platform/credentials/git">
    GitHub, GitLab, and other Git providers for GitOps.
  </Card>

  <Card title="Hetzner" icon="cloud" href="/platform/credentials/hetzner">
    Hetzner Cloud API token for cluster provisioning.
  </Card>

  <Card title="OVH" icon="cloud" href="/platform/credentials/ovh">
    OVHcloud application keys and Public Cloud project.
  </Card>

  <Card title="DigitalOcean" icon="digital-ocean" href="/platform/credentials/digitalocean">
    DigitalOcean personal access token for droplets and DOKS.
  </Card>

  <Card title="UpCloud" icon="cloud" href="/platform/credentials/upcloud">
    UpCloud subaccount API access for servers and UKS.
  </Card>

  <Card title="AWS" icon="aws" href="/platform/credentials/aws">
    IAM role or access keys for cost, inventory, and EKS.
  </Card>

  <Card title="Google Cloud (GCP)" icon="google" href="/platform/credentials/gcp">
    Read-only service account for cost, discovery, and GKE.
  </Card>

  <Card title="Azure" icon="microsoft" href="/platform/credentials/azure">
    Service principal for provisioning AKS.
  </Card>

  <Card title="Proxmox VE" icon="server" href="/platform/credentials/proxmox">
    Proxmox API URL and token for self-managed clusters.
  </Card>

  <Card title="Morpheus" icon="server" href="/platform/credentials/morpheus">
    Morpheus appliance URL and access token.
  </Card>

  <Card title="SSH Key" icon="lock" href="/platform/credentials/ssh-key">
    SSH keys for server access on self-managed clusters.
  </Card>
</CardGroup>

## Compare credential types

| Credential         | Used for                                          | CLI command                                                                  | Guide                                              |
| ------------------ | ------------------------------------------------- | ---------------------------------------------------------------------------- | -------------------------------------------------- |
| Registry           | Sync Helm charts / images from private registries | — (UI/API)                                                                   | [Registry](/platform/credentials/registry)         |
| Git                | GitOps configuration sync                         | — (via GitHub App)                                                           | [Git](/platform/credentials/git)                   |
| Hetzner            | Provision Hetzner clusters                        | `ankra credentials hetzner`                                                  | [Hetzner](/platform/credentials/hetzner)           |
| OVH                | Provision OVH clusters and OVHcloud MKS           | `ankra credentials ovh`                                                      | [OVH](/platform/credentials/ovh)                   |
| DigitalOcean       | Provision droplet clusters and DOKS               | `ankra credentials digitalocean`                                             | [DigitalOcean](/platform/credentials/digitalocean) |
| UpCloud            | Provision UpCloud clusters and UKS                | `ankra credentials upcloud`                                                  | [UpCloud](/platform/credentials/upcloud)           |
| AWS                | Cost, inventory, and EKS                          | — (UI/API)                                                                   | [AWS](/platform/credentials/aws)                   |
| Google Cloud (GCP) | Cost, discovery, and GKE                          | — (UI/API)                                                                   | [GCP](/platform/credentials/gcp)                   |
| Azure              | Provision AKS                                     | — (portal/API)                                                               | [Azure](/platform/credentials/azure)               |
| Proxmox VE         | Provision self-managed Proxmox clusters           | — (UI/API)                                                                   | [Proxmox VE](/platform/credentials/proxmox)        |
| Morpheus           | Provision self-managed Morpheus clusters          | — (UI/API)                                                                   | [Morpheus](/platform/credentials/morpheus)         |
| SSH Key            | Server access on self-managed clusters            | `ankra credentials <provider> ssh-key` (Hetzner, OVH, DigitalOcean, UpCloud) | [SSH Key](/platform/credentials/ssh-key)           |

***

## Using credentials

Credentials are selected by name where they're needed:

* **Registries**: when adding a Helm registry, pick the [registry credential](/platform/credentials/registry) from the dropdown.
* **Clusters**: when provisioning or importing a cluster, pick the matching cloud credential (and an [SSH key](/platform/credentials/ssh-key) for self-managed clusters).
* **GitOps**: the [Git connection](/platform/credentials/git) is used automatically when syncing configuration.

***

## Managing credentials

### View credentials

Go to **Credentials** to see all stored credentials:

* Name and type
* Creation date
* Associated registries and clusters (if any)

### Update a credential

1. Click on the credential name
2. Update the fields
3. Click **Save**

<Note>
  Updating a credential automatically applies to everything using it. No need to reconfigure registries or clusters.
</Note>

### Delete a credential

1. Go to **Credentials**
2. Click the menu (⋮) next to the credential
3. Select **Delete**

<Warning>
  Deleting a credential will break authentication for anything using it. Update those integrations first.
</Warning>

***

## Security

### Storage

Credentials are stored securely using HashiCorp Vault:

* Encrypted at rest
* Access controlled per organisation
* Audit logging for all access

### Best practices

<CardGroup cols={2}>
  <Card title="Use Tokens, Not Passwords" icon="key">
    Prefer access tokens over account passwords. Tokens can be scoped and revoked independently.
  </Card>

  <Card title="Minimum Permissions" icon="shield">
    Grant only the permissions needed. For chart sync and cost, read-only access is enough.
  </Card>

  <Card title="Rotate Regularly" icon="rotate">
    Rotate credentials periodically, especially for production.
  </Card>

  <Card title="Separate by Environment" icon="layer-group">
    Use different credentials for dev, staging, and production.
  </Card>
</CardGroup>

***

## Troubleshooting

### Authentication errors

| Error              | Cause                    | Solution                            |
| ------------------ | ------------------------ | ----------------------------------- |
| 401 Unauthorized   | Invalid credentials      | Verify username and password/token  |
| 403 Forbidden      | Insufficient permissions | Check the token has required scopes |
| Token expired      | Temporary tokens (ECR)   | Refresh the token                   |
| Connection refused | Network issue            | Check firewall and network access   |

For provider-specific troubleshooting, see the individual credential pages (for example [GCP](/platform/credentials/gcp)).

***

## API access

Manage credentials via the Ankra API:

```python theme={null}
import requests

headers = {"Authorization": f"Bearer {TOKEN}"}

# List credentials
response = requests.get(
    "https://platform.ankra.app/api/v1/credentials",
    headers=headers
)

# Create credential
response = requests.post(
    "https://platform.ankra.app/api/v1/credentials",
    headers=headers,
    json={
        "name": "my-registry-auth",
        "provider": "registry",
        "username": "myuser",
        "password": "mytoken"
    }
)
```

See the [API Reference](/api-reference/introduction) for complete documentation.