OVHcloud connection

Learn how to configure an OVHcloud connection for Infisical.

Infisical authenticates to OVHcloud Key Management Service (OKMS) using one of two methods:

• Certificate (mTLS): a PEM-encoded client certificate and private key that OVHcloud issues for your KMS domain
• Token: an OVHcloud KMS access token

If you use a token, skip to Create an OVHcloud connection in Infisical. To create the token, see the OVHcloud KMS authentication guide.

​

Generate an OVHcloud KMS access certificate

1. Open the OVHcloud KMS dashboard

   Log in to the OVHcloud Control Panel and navigate to Identity, Security & Operations > Key Management Service.

   
2. Create an OVHcloud KMS domain

   Select Order an OKMS Domain.

   
3. Select your OVHcloud KMS region

   Select the OVHcloud KMS region that you want to use, then accept the terms to confirm.

   
4. Check your summary

   On the summary page, select your domain.

   

   You’ll need the following values to create the connection:

   • OKMS ID: the UUID-style identifier on the summary page (the KMS ID field in Infisical)

   • REST API endpoint: the base URL of your KMS domain, such as https://eu-west-rbx.okms.ovh.net (the REST API Endpoint field in Infisical)

     
5. Generate an access certificate

   Open the Access certificate tab.

   

   Select Generate an access certificate.

   

   Define the validity of the certificate and download the two PEM files offered:

   • *_privatekey.pem: the private key

   • *_certificate.pem: the public certificate

     

   Infisical doesn’t support the PKCS12 (.p12) format. If OVHcloud offers a PKCS12 download or asks you to convert the PEM files with openssl pkcs12, ignore those options and keep the PEM files as they are. If you provide a PKCS12 bundle, the connection fails with Unsupported PKCS12 PFX data.

​

Create an OVHcloud connection in Infisical

Infisical UI

1. Navigate to App Connections

   In your Infisical dashboard, navigate to the Integrations tab in the desired project, then select App Connections.

   
2. Select OVHcloud Connection

   Select + Add Connection, then select OVHcloud Connection from the list of integrations.

   
3. Fill out the OVHcloud connection form

   Complete the form by providing:

   • Name: a descriptive name for the connection
   • Description (optional)
   • Method: Certificate or Token

   If you selected Certificate:

   • Private Key (PEM): paste the full contents of *_privatekey.pem, including the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines
   • Certificate (PEM): paste the full contents of *_certificate.pem, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines

   If you selected Token:

   • Token: paste your OVHcloud KMS access token

   For both methods:

   • REST API Endpoint: the base URL of your KMS domain, such as https://eu-west-rbx.okms.ovh.net (don’t include /api, because Infisical adds it)

   • KMS ID: the KMS ID from the OVHcloud Control Panel

     

   Infisical checks the credentials when you create the connection, so the OVHcloud IAM policy for your certificate or token must include okms:apikms:serviceKey/get in addition to the secret permissions that the sync uses.

4. Connection created

   After you submit the form, your OVHcloud connection is created and ready to use with Secret Syncs.

   

API

To create an OVHcloud connection through the API, send a request to the Create OVHcloud Connection endpoint.

​

Sample request with a certificate

Request

curl    --request POST \
        --url https://app.infisical.com/api/v1/app-connections/ovh \
        --header 'Authorization: Bearer <your-infisical-access-token>' \
        --header 'Content-Type: application/json' \
        --data '{
            "name": "my-ovh-connection",
            "method": "certificate",
            "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
            "credentials": {
                "privateKey": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
                "certificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n",
                "okmsDomain": "https://eu-west-rbx.okms.ovh.net",
                "okmsId": "00000000-0000-0000-0000-000000000000"
            }
        }'

​

Sample request with a token

Request

curl    --request POST \
        --url https://app.infisical.com/api/v1/app-connections/ovh \
        --header 'Authorization: Bearer <your-infisical-access-token>' \
        --header 'Content-Type: application/json' \
        --data '{
            "name": "my-ovh-connection",
            "method": "bearer-token",
            "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
            "credentials": {
                "token": "<your-ovhcloud-kms-token>",
                "okmsDomain": "https://eu-west-rbx.okms.ovh.net",
                "okmsId": "00000000-0000-0000-0000-000000000000"
            }
        }'

​

Sample response

Response

{
  "appConnection": {
      "id": "a1b2c3d4-5678-90ab-cdef-1234567890ab",
      "name": "my-ovh-connection",
      "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
      "description": null,
      "version": 1,
      "orgId": "abcdef12-3456-7890-abcd-ef1234567890",
      "createdAt": "2026-04-23T10:15:00.000Z",
      "updatedAt": "2026-04-23T10:15:00.000Z",
      "isPlatformManagedCredentials": false,
      "credentialsHash": "d41d8cd98f00b204e9800998ecf8427e",
      "app": "ovh",
      "method": "certificate",
      "credentials": {}
  }
}