API tokens
An API token lets you reach the HepCloud API from outside the console — for Terraform, command line tools or your own scripts.
Creating a token
Go to API Tokens → Create token.
The token is shown only once
Copy it then and store it safely. If you lose it, create a new one — the existing token cannot be recovered; we cannot see it either, only a digest is stored.
Choosing permissions
| Permission | What it can do |
|---|---|
| Read | List and view; cannot change anything |
| Read-write | Create and delete servers, power actions, rule changes |
If your automation only reads state, give it read permission. A read-only
token that sends a write request receives a token_readonly error.
Tokens are project-scoped
Every token belongs to the project it was created in and sees only that project's resources. Reaching for another project's server returns "not found". If you automate several projects, create a token per project.
Account operations are closed to the API
Account security (two-factor authentication, sessions), token management, billing details and balance operations happen in the console only. Even if a token leaks, it cannot take over your account, mint new tokens or touch your two-factor authentication.
Usage
curl -H "Authorization: Bearer <token>" https://api.hepcloud.net/v1/servers
See the API reference for the full endpoint list.
Security tips
- Do not commit tokens to a code repository; use environment variables or a secret manager.
- Create a separate token per automation, so revoking one does not affect the others.
- Delete tokens you no longer use. The console shows each token's last use.