> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OVHcloud connection > Learn how to configure an OVHcloud connection for Infisical. Infisical authenticates to [OVHcloud Key Management Service (OKMS)](https://www.ovhcloud.com/en/identity-security-operations/secret-manager/) using one of two methods: * **Certificate (mTLS):** a PEM-encoded client certificate and private key that OVHcloud issues for your KMS domain * **Token:** an OVHcloud KMS access token If you use a token, skip to [Create an OVHcloud connection in Infisical](#create-an-ovhcloud-connection-in-infisical). To create the token, see the [OVHcloud KMS authentication guide](https://docs.ovhcloud.com/en/guides/manage-and-operate/kms/okms-authentication-methods). ## Generate an OVHcloud KMS access certificate **1. Open the OVHcloud KMS dashboard** Log in to the [OVHcloud Control Panel](https://www.ovh.com/manager/) and navigate to **Identity, Security & Operations** > **Key Management Service**. ![OVHcloud KMS Dashboard](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/ovh/okms-dashboard.png) **2. Create an OVHcloud KMS domain** Select **Order an OKMS Domain**. ![OVHcloud KMS Dashboard](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/ovh/okms-order-domain.png) **3. Select your OVHcloud KMS region** Select the OVHcloud KMS region that you want to use, then accept the terms to confirm. ![OVHcloud KMS Region](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/ovh/okms-select-region.png) ![OVHcloud KMS Activate Region](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/ovh/okms-activate-region.png) **4. Check your summary** On the summary page, select your domain. ![OVHcloud KMS Summary](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/ovh/okms-summary.png) You'll need the following values to create the connection: * **OKMS ID**: the UUID-style identifier on the summary page (the **KMS ID** field in Infisical) * **REST API endpoint**: the base URL of your KMS domain, such as `https://eu-west-rbx.okms.ovh.net` (the **REST API Endpoint** field in Infisical) ![OVHcloud KMS Details](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/ovh/okms-details.png) **5. Generate an access certificate** Open the **Access certificate** tab. ![Access Certificate Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/ovh/okms-certificate-tab.png) Select **Generate an access certificate**. ![Generate Access Certificate](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/ovh/generate-access-certificate.png) Define the validity of the certificate and download the two PEM files offered: * `*_privatekey.pem`: the private key * `*_certificate.pem`: the public certificate ![Create Access Certificate](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/ovh/okms-create-certificate.png) > [!WARNING] > > Infisical doesn't support the PKCS12 (`.p12`) format. If OVHcloud offers a PKCS12 download or asks you to convert the PEM files with `openssl pkcs12`, ignore those options and keep the PEM files as they are. If you provide a PKCS12 bundle, the connection fails with `Unsupported PKCS12 PFX data.` ## Create an OVHcloud connection in Infisical > [tab] Infisical UI > > **1. Navigate to App Connections** > > In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**. > > ![App Connections Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/general/add-connection.png) > > **2. Select OVHcloud Connection** > > Select **+ Add Connection**, then select **OVHcloud Connection** from the list of integrations. > > ![Select OVHcloud Connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/ovh/app-connection-option.png) > > **3. Fill out the OVHcloud connection form** > > Complete the form by providing: > > * **Name**: a descriptive name for the connection > * **Description** (optional) > * **Method**: **Certificate** or **Token** > > If you selected **Certificate**: > > * **Private Key (PEM)**: paste the full contents of `*_privatekey.pem`, including the `-----BEGIN PRIVATE KEY-----` and `-----END PRIVATE KEY-----` lines > * **Certificate (PEM)**: paste the full contents of `*_certificate.pem`, including the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines > > If you selected **Token**: > > * **Token**: paste your OVHcloud KMS access token > > For both methods: > > * **REST API Endpoint**: the base URL of your KMS domain, such as `https://eu-west-rbx.okms.ovh.net` (don't include `/api`, because Infisical adds it) > * **KMS ID**: the KMS ID from the OVHcloud Control Panel > > ![OVHcloud Connection Form](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/ovh/app-connection-form.png) > > Infisical checks the credentials when you create the connection, so the OVHcloud IAM policy for your certificate or token must include `okms:apikms:serviceKey/get` in addition to the secret permissions that the sync uses. > > **4. Connection created** > > After you submit the form, your OVHcloud connection is created and ready to use with Secret Syncs. > > ![OVHcloud Connection Created](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/ovh/app-connection-created.png) > [tab] API > > To create an OVHcloud connection through the API, send a request to the [Create OVHcloud Connection](https://infisical.com/docs/api-reference/endpoints/app-connections/ovh/create.md) endpoint. > > ### Sample request with a certificate > > ```bash Request theme={"dark"} > curl --request POST \ > --url https://app.infisical.com/api/v1/app-connections/ovh \ > --header 'Authorization: Bearer ' \ > --header 'Content-Type: application/json' \ > --data '{ > "name": "my-ovh-connection", > "method": "certificate", > "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78", > "credentials": { > "privateKey": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n", > "certificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n", > "okmsDomain": "https://eu-west-rbx.okms.ovh.net", > "okmsId": "00000000-0000-0000-0000-000000000000" > } > }' > ``` > > ### Sample request with a token > > ```bash Request theme={"dark"} > curl --request POST \ > --url https://app.infisical.com/api/v1/app-connections/ovh \ > --header 'Authorization: Bearer ' \ > --header 'Content-Type: application/json' \ > --data '{ > "name": "my-ovh-connection", > "method": "bearer-token", > "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78", > "credentials": { > "token": "", > "okmsDomain": "https://eu-west-rbx.okms.ovh.net", > "okmsId": "00000000-0000-0000-0000-000000000000" > } > }' > ``` > > ### Sample response > > ```bash Response theme={"dark"} > { > "appConnection": { > "id": "a1b2c3d4-5678-90ab-cdef-1234567890ab", > "name": "my-ovh-connection", > "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78", > "description": null, > "version": 1, > "orgId": "abcdef12-3456-7890-abcd-ef1234567890", > "createdAt": "2026-04-23T10:15:00.000Z", > "updatedAt": "2026-04-23T10:15:00.000Z", > "isPlatformManagedCredentials": false, > "credentialsHash": "d41d8cd98f00b204e9800998ecf8427e", > "app": "ovh", > "method": "certificate", > "credentials": {} > } > } > ``` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.