closedloop.email
Blog How it works Contact Sign in Get a loop

How to create a Hetzner Cloud API token

2026-07-22

Hetzner Cloud is our recommended provider — it is the cheapest (around €4/month for a 2 GB server) and the one we use ourselves. Here is how to create an API token with the permissions closedloop needs.

What you need

  • A Hetzner Cloud account. If you do not have one, sign up at hetzner.com/cloud. New accounts get €20 in free credit.
  • A project. Hetzner organizes resources into projects. If this is your first time, one is created automatically.

Step by step

  1. Log in to the Hetzner Cloud Console and select your project.

  2. Click Security in the left sidebar.

  3. Go to the API Tokens tab.

  4. Click Generate API Token.

  5. Enter a description — something like closedloop so you remember what it is for.

  6. Select Read & Write as the permission. This allows closedloop to create the server, firewall, and SSH key in your project. Without write access, provisioning will fail.

  7. Click Generate API Token. The token is shown once. Copy it immediately — there is no way to see it again.

What closedloop does with it

When you paste this token into closedloop:

  1. We validate it by listing your existing SSH keys.
  2. We upload our admin SSH key (remote-admin@closedloop.email) into your project — this is how we provision the server.
  3. After provisioning, the server is yours. You can remove our SSH key from the loop dashboard under Support access.
  4. The token is deleted as soon as the loop is provisioned — we do not keep it. If you later choose to destroy the loop, you provide a token again for that one action, and it is discarded afterwards.

Minimum permissions

Hetzner does not support scoped tokens. The only options are Read or Read & Write. closedloop needs Write access to create resources.

Rotating the token

If you ever want to revoke our access, delete the token from Hetzner Cloud Console → Security → API Tokens. Your existing loop will keep running — the token is only needed at provision and destroy time. To destroy the loop later, you will need to provide a valid token.

Create your loop →

More for you: