How to configure a Personal Access Token (PAT)

Objective

Personal Access Tokens (PATs) let an OVHcloud IAM local user authenticate with the OVHcloud API and product backend APIs without sharing their login credentials. A PAT is a bearer token whose permissions are defined by the IAM policies attached to the user.

Unlike service account credentials, which are designed for machine-to-machine interactions, PATs are intended for scripts or applications acting on behalf of a local user.

This guide explains how to configure a Personal Access Token (PAT) for an OVHcloud IAM local user.

Requirements

• An OVHcloud customer account.
• A local IAM user, or permission to create one.
• IAM policies granting the user the actions required for your use case.

OVHcloud Control Panel Access

• Direct link: IAM Identities
• Navigation path: Identity, Security & Operations > Identities

Instructions

Understand Personal Access Tokens

PATs are linked to a single local user identity. When you use a PAT, the API calls inherit the rights of that user according to the IAM policies applied to them.

Key characteristics:

• Authentication scheme: Bearer token (Authorization: Bearer <token>).
• Expiration: By default, a PAT does not expire. You can optionally set an expiration date when creating it.
• Revocation: Delete the PAT at any time to immediately revoke access.
• One-time display: The token value is only shown once at creation. Store it securely.

See Identities management.

Create a Personal Access Token

Replace {user} with your local user login (for example, 1234-567-89/johnsmith).

Via the OVHcloud Control Panel

Via the OVHcloud API

Via the OVHcloud CLI

From the IAM Identities page, click the … button at the end of the local user row, then select Manage tokens.

On the Manage Tokens page, click Add a token, then fill in the required fields:

Field	Details
Name	A unique name to identify the token (for example, pat-my-script).
Description	A short description of how the token will be used.
Expiry date	Optional. Disable the toggle for a non-expiring token, or set a duration or a fixed date.

Click Create to generate the token.

Warning

Copy the token value immediately and store it in a secure location. It will not be displayed again.

Use the following API call:

🇪🇺EU▾

POST/me/identity/user/{user}/token

With the following payload (fill in your own values):

{
  "description": "PAT for my automation script",
  "name": "pat-my-script"
}

The API returns a response similar to the following:

{
  "creation": "2025-11-13T10:38:44.658926311Z",
  "description": "PAT for my automation script",
  "expiresAt": null,
  "lastUsed": null,
  "name": "pat-my-script",
  "token": "eyJhbGciOiJ..."
}

Warning

Save the value of the token field securely. It cannot be retrieved later.

To set an expiration date, add an expiresAt field to the payload using the RFC3339 format (for example, "expiresAt": "2026-12-31T23:59:59Z").

Use the OVHcloud CLI to create the PAT:

ovhcloud iam user token create {user} \
  --name pat-my-script \
  --description "PAT for my automation script"

The CLI returns the token value:

✅ Token pat-my-script created successfully, value: eyJhbGciOiJ...

To store the token directly in an environment variable:

PAT_TOKEN=$(ovhcloud iam user token create {user} \
  --name pat-my-script \
  --description "PAT for my automation script" \
  -o json | jq -r .details.token)
echo $PAT_TOKEN

To create a token that expires after a set duration, use the --expiresIn flag (value in seconds) or --expiredAt (RFC3339 date).

Use a Personal Access Token

Use the PAT as a Bearer token in the Authorization header of your HTTP requests.

To retrieve information about your OVHcloud account:

curl -H "Authorization: Bearer <your_pat>" \
  https://eu.api.ovh.com/1.0/me

Depending on the location of your account, use the appropriate API endpoint:

• EU: https://eu.api.ovh.com/1.0/
• CA: https://ca.api.ovh.com/1.0/

For product backend APIs that do not support the Bearer scheme, you can use hybrid authentication by prefixing the username with pat_jwt_ and supplying the token as the password:

curl -u "pat_jwt_<any_suffix>:<your_pat>" \
  https://<your_cluster>.logs.ovh.com:9200/_cluster/health?pretty

Replace <any_suffix> with any ASCII string to identify the token.

Manage and revoke tokens

List existing tokens

Via the OVHcloud Control Panel

Via the OVHcloud API

Via the OVHcloud CLI

On the Manage Tokens page, all PATs for the user are listed.

🇪🇺EU▾

GET/me/identity/user/{user}/token

ovhcloud iam user token list {user}

Delete a token

Deleting a PAT immediately blocks further API calls.

ovhcloud iam user token delete {user} pat-my-script

Go further

• First Steps with the OVHcloud APIs

Join our community of users.