Docs / Clouds
Hetzner
Connect a Hetzner Cloud project with a project-scoped API token to manage servers, networks and more.
Pangea authenticates to Hetzner Cloud with a project-scoped API token. The agent can then inspect and operate the resources in that project.
Connect
Create an API token
In the Hetzner Cloud Console, open your project and go to Security → API Tokens. Choose Read for inspection, or Read & Write when the agent needs to make changes.
Hetzner tokens are scoped to a single project. To work with several projects, connect one token per project.
Connect in Pangea
In Connectors → Connect → Hetzner Cloud, enter:
| Field | Notes |
|---|---|
| Label | A friendly name, for example "My Hetzner Project" |
| API Token | The project token you created |
Pangea checks the token against the Hetzner API before it saves. An invalid or revoked token is rejected. The token is stored encrypted.
In the Pangea app
The bound project gets a Servers page that lists its Cloud servers with status, type and addresses. Everything else, such as volumes, networks, firewalls and load balancers, goes through the agent. The binding lives in Connectors, where an Administrator can manage its allow-list or remove it.
What the agent can do for you
The agent operates Hetzner Cloud with the hcloud CLI in its sandbox: servers, volumes, networks, firewalls, load balancers, floating IPs and images. Ask it things like:
- "What's running in the Hetzner project, and what does it cost?" It lists servers and resources and sums them up.
- "Provision a new server for the staging runner." It proposes a plan and creates the server once you approve.
- "Open port 443 on the web firewall." Name the exact rule you want, then review the resulting firewall policy.
Permissions and authorization
Team Administrators connect and remove this binding and can restrict it with a member allow-list. Select the connection for the conversation before you ask the agent to use it. The token's permissions stay the outer limit, whatever the prompt or permission mode.
Individual actions follow Auto Mode and Full Access. Significant cloud infrastructure work uses plans. A routine API action does not create a plan on its own, so say so explicitly when you want to review changes first.
Good to know
Hetzner Cloud has no managed Kubernetes, so there are no clusters or kubeconfigs to pull here. If you run your own Kubernetes on Hetzner, connect it through the cluster relay. See On-prem Kubernetes.