> ## Documentation Index
> Fetch the complete documentation index at: https://docs.monk.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Run on Hetzner

> Connect Monk to your Hetzner Cloud account

Monk needs an API token to provision and manage infrastructure in your Hetzner Cloud account. Like DigitalOcean, this is a simple token-based setup.

## What You Need

* Hetzner Cloud API Token
* Optional: default region (e.g., `eu-central`)

## Create Credentials

<Steps>
  <Step title="Open the Hetzner Cloud Console">
    Log into [Hetzner Cloud Console](https://console.hetzner.cloud) and select the project you want Monk to manage.
  </Step>

  <Step title="Go to API Tokens">
    In the left sidebar, navigate to **Security** > **API Tokens**.
  </Step>

  <Step title="Generate a token">
    Click **Generate API Token**. Name it something like `monk-deployment`. Select **Read & Write** permissions.
  </Step>

  <Step title="Copy the token">
    Copy the token immediately — it is shown only once and cannot be retrieved later.
  </Step>

  <Step title="Provide to Monk">
    When you deploy to Hetzner, Monk requests the token through a secure form in your IDE. You can also tell your agent:

    ```
    ask Monk to update my Hetzner credentials
    ```
  </Step>
</Steps>

## Required Permissions

The token needs **Read & Write** permissions. Hetzner tokens are scoped to a single project — one token cannot access resources in other projects. There is no fine-grained permission model; Read & Write grants full access to all resources within the project.

## How Credentials Are Stored

Credentials are encrypted at rest in your IDE's secret storage and on your Monk cluster using your cloud provider's KMS — so your infrastructure can manage itself autonomously. They are never sent to Monk servers and never exposed to the LLM. See [Security](/features/security) for full details.

## Troubleshooting

**Token revoked** — generate a new token from Security > API Tokens in the Hetzner Cloud Console and update credentials in Monk.

**Wrong project** — Hetzner tokens are project-scoped. Make sure you generated the token in the correct project.

**Insufficient permissions** — make sure the token has Read & Write. Read-only tokens cannot provision infrastructure.

Ask your agent for help:

```
ask Monk why my Hetzner credentials are not working
```

<Card title="Deploy your first app" icon="rocket" href="/getting-started/first-deployment" color="#3B82F6">
  Credentials ready — now deploy
</Card>