Deploy with OVHcloud

Deploy with OVHcloud

AI Deploy can create a Hermes or OpenClaw server in your OVHcloud Public Cloud project. You keep ownership of the project, server, and billing.

OVHcloud uses four values instead of one cloud token:

• an application key;
• an application secret;
• a consumer key;
• the Public Cloud service name used by the API.

What you need

• An OVHcloud account with an active Public Cloud project.
• A payment method and enough quota for at least 2 vCPU and 4 GB RAM.
• Permission to create API credentials for that account.
• An enabled compute region in the project.

1. Choose your OVHcloud account endpoint

Use the account site where you normally sign in, not the physical location where you want the server:

Select the same choice in the AI Deploy wizard before pasting the credentials.

2. Copy the Public Cloud service name

1. Open OVHcloud Manager.
2. Select the Public Cloud project that should own the server.
3. Copy its API service name. It is normally a 32-character identifier.

Do not paste the editable project display name. The service name is the value OVHcloud uses in API paths such as /cloud/project/<service-name>.

3. Create a restricted API token

Open the token creator from step 1 and add these access rules, replacing <service-name> with the value you copied:

GET    /cloud/project/<service-name>
GET    /cloud/project/<service-name>/*
POST   /cloud/project/<service-name>/instance
DELETE /cloud/project/<service-name>/instance/*

These rules let AI Deploy read the live region, flavor, image, and instance catalog; create one server; monitor it; and delete the matching server during cleanup. They do not grant access to domains, account settings, or billing profiles.

Set an expiration date that covers the deployment. The token creator returns the application key, application secret, and consumer key. Save all three in a password manager before leaving the page.

4. Connect OVHcloud in AI Deploy

1. Choose OVHcloud on the Cloud step.
2. Select the same account endpoint used to create the token.
3. Paste the application key, application secret, consumer key, and Public Cloud service name.
4. Select Connect.
5. Choose one of the verified regions and an available server size.
6. Confirm that billing and quota are active, then continue through the wizard.

Connecting is read-only. AI Deploy checks the project and its live catalog but does not create a server until you select Launch on the Review step.

What AI Deploy creates

AI Deploy selects the smallest available Linux flavor that meets the chosen size instead of relying on a project-specific flavor ID:

The estimate is not a quote. OVHcloud pricing and available flavors vary by project and region.

The server name starts with aideploy-. Its host firewall denies inbound traffic by default, allows your Tailscale private network, and opens public HTTPS only when a selected messaging channel needs webhook delivery.

Verification

After you select Connect, the wizard should:

• show only regions enabled in your project;
• show the live OVHcloud flavor selected for each available size;
• ask you to confirm billing and quota before launch.

After launch, open OVHcloud Manager and confirm that one aideploy-... instance appears in the selected project and region. The wizard's progress screen then shows the runtime installation and private-access details.

Troubleshooting

OVHcloud rejected the credentials

Check these items in order:

1. The wizard account endpoint matches the token creator.
2. All three keys came from the same token creation result.
3. The service name is the API identifier, not the project display name.
4. The token includes every GET rule above.
5. The token has not expired or been revoked.

Create a new restricted token if any value is uncertain. Rotating all three credential values together is safer than mixing values from different tokens.

The project has no enabled regions

Enable a compute region in OVHcloud Manager, wait for the project update to finish, and select Connect again.

No server size is available

Choose another verified region. If every region is unavailable, free project capacity or ask OVHcloud to raise the instance quota.

Verification succeeds but launch is denied

The token can read the project but cannot create a server. Add the POST instance rule shown above, create a replacement token, and reconnect it in the wizard. Cleanup also needs the DELETE instance rule.

A failed launch left a server behind

AI Deploy reconciles servers by their deterministic aideploy-<deploy-id> name and attempts automatic cleanup. If cleanup cannot use an expired or revoked token, delete only the matching instance in OVHcloud Manager.

Keep the credentials safe

• Paste the keys only into the AI Deploy wizard, never into chat or a support message.
• The wizard keeps cloud credentials in the current browser session, not in long-lived local storage.
• Revoke or rotate the consumer key after deployment if you do not need AI Deploy to perform later cleanup.
• OVHcloud Object Storage uses separate S3 credentials; the compute token does not configure backups.

Related guides

• Cloud Providers
• Private Access
• Troubleshooting