> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuphos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Tencent Cloud

> Connect a Tencent Cloud account with OIDC role SSO — no SecretId/SecretKey to store.

Nuphos reaches Tencent Cloud through **OIDC web-identity federation**. You create
a CAM identity provider that trusts the Nuphos issuer and a role that trusts that
provider; Nuphos mints a short-lived token per team and calls
`sts:AssumeRoleWithWebIdentity`.

**No SecretId/SecretKey is stored.** Nuphos keeps the role ARN and the OIDC
provider's name — Tencent references providers by name, not ARN.

<Note>
  Pick your partition when you connect: **mainland China**
  (`console.cloud.tencent.com`) or **International**
  (`console.tencentcloud.com`). They are separate accounts with separate
  consoles.
</Note>

## Connect

The wizard in **Connectors → Connect → Tencent Cloud** shows the values for your
team — issuer, client id, subject, and the public key. Copy them from there, not
from this page.

### 1. Add the identity provider

In the CAM console, open **Identity Providers → Role SSO** and create an **OIDC**
provider with the issuer URL, client id, and public key the wizard gives you.

Unlike AWS and Azure, **Tencent does not fetch the issuer's JWKS itself**, so the
wizard hands you the public key to paste. If Nuphos rotates its signing key, this
provider has to be updated.

### 2. Create the role

Create a role that trusts the provider you just made, conditioned on the
**subject** the wizard shows — that is what locks the role to your team, so no
other Nuphos team can assume it.

Attach a policy covering the work you want done (TKE and CVM, typically). Copy
the role's **ARN**; the last step asks for it.

### 3. Authorize cluster access (optional)

Tencent's IAM only covers the control plane. To let the role act *inside* your
TKE clusters, grant it access in each cluster as well. Skip this if you only want
the agent to see cluster metadata.

### 4. Bind the role

Enter the role ARN and the provider name in Nuphos.

## In the Nuphos app

* **CVM instances** — the account's compute instances.
* **Clusters** — TKE clusters land in the shared
  [cluster browser](/infrastructure/clusters) alongside EKS, GKE, and the rest.

## What the agent can do for you

The agent operates the account within whatever policy you attached to the role,
correlating it with your other [connected accounts](/connectors/overview) and
proposing changes as [plans](/agent/plans).

## Permissions & authorization

* **The role's policy** is the outer limit — Tencent enforces it.
* **Hard boundary — who can use it.** Only team **Administrators** can bind or
  remove the account, and they can restrict it to specific members with a
  [member allow-list](/security/access-control).
* **Soft boundary — what the agent may do with it.** Reads run freely; changes go
  through [plan approvals](/security/approvals) and
  [Auto-authorization](/security/auto-mode).

See the [IAM trust model](/security/iam-trust) for how the token exchange works.