> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuphos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Hetzner

> Connect a Hetzner Cloud project to manage servers, networks, and more.

Nuphos authenticates to Hetzner Cloud with a **project-scoped API token**, which
lets the agent inspect and operate the resources in that project.

## Connect

### Create an API token

In the Hetzner Cloud Console, open your project and go to **Security → API
Tokens**. Create a token with **Read & Write** access.

Hetzner tokens are scoped to a single project — to work with several projects,
connect one token per project.

### Connect in Nuphos

In **Connectors → Connect → Hetzner Cloud**, enter:

| Field         | Notes                                      |
| ------------- | ------------------------------------------ |
| **Label**     | A friendly name, e.g. "My Hetzner Project" |
| **API Token** | The project token you created              |

Nuphos verifies the token against the Hetzner API before saving; an invalid or
revoked token is rejected. The token is stored encrypted.

## In the Nuphos app

Hetzner work happens primarily **through the agent** — there's no dedicated
browsing surface for Hetzner resources yet. The binding itself lives in
**Connectors**, where an Administrator can manage its allow-list or remove it.

## What the agent can do for you

The agent operates Hetzner Cloud via the `hcloud` CLI in its sandbox — servers,
volumes, networks, firewalls, load balancers, floating IPs, and images. Ask it
things like:

* *"What's running in the Hetzner project, and what does it cost?"* — it lists
  servers and resources and summarizes.
* *"Provision a new server for the staging runner"* — it proposes a
  [plan](/agent/plans), and creates the server once you approve.
* *"Open port 443 on the web firewall"* — a change, so it pauses for your yes.

## Permissions & authorization

Two boundaries govern what happens through this connector:

* **Hard boundary — who can use it.** Only team **Administrators** can bind or
  remove the token, and they can restrict it to specific members with a
  [member allow-list](/security/access-control). Within a session the agent only
  holds credentials you explicitly selected, re-checked on every request.
* **Soft boundary — what the agent may do with it.** Reads are free-form;
  changes (create, delete, resize, reboot, …) always go through
  [plan approvals](/security/approvals), and
  [Auto-authorization](/security/auto-mode) governs each `hcloud` command —
  read-only ones run on their own, destructive ones pause for a human, and your
  standing rules cover the middle.

The outer limit is the token itself: it's scoped to one project, so the agent
can never reach beyond that project no matter what it's asked.

## Good to know

<Info>
  Hetzner Cloud has no managed Kubernetes offering, so there are no clusters or
  kubeconfigs to pull here. If you run self-managed Kubernetes on Hetzner, give
  the agent a kubeconfig directly — see
  [Kubernetes clusters](/infrastructure/clusters).
</Info>