Projects, tokens and SSH keys

Everything in Hetzner Cloud lives inside a project: Servers, volumes, networks, firewalls, IP addresses and the tokens that manage them. Nothing in one project can see another.

my-app-prodprojecttoken: my-app-prod

web-1Server · fsn1

dataVolume

webFirewall

my-app-devprojecttoken: my-app-dev

web-samServer · fsn1

web-pr-42Server · fsn1

Each project holds its own servers, disks and firewalls, and each token reaches one project. Many stages share the development project.

A token reaches one project

An API token is created inside a project, under Security → API tokens, and reaches only that project. So the token is how you choose where Alchemy deploys. Give it Read & Write access, so Alchemy can create resources, and store it in a profile:

alchemy profile edit --add Hetzner

See Setup for the details.

One project per environment

Because a token reaches one project, separate projects give you hard isolation. Use one for production and another for everything else, each with its own token and profile:

alchemy profile create prod
alchemy profile edit --profile prod --add Hetzner
alchemy deploy --stage prod --profile prod

Many stages can share the development project, each with its own Servers.

SSH keys

A Server is a whole machine, and you sign in to it over SSH. An SSH key registers your public key with the project, so Servers created with it accept your key, and never a password:

alchemy.run.ts

const key = yield* Hetzner.SshKey("deploy", {
  publicKey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI… you@laptop",
});

See Servers for attaching keys to a Server.

In CI

With CI=true, Alchemy skips the profile and reads HCLOUD_TOKEN from the environment. See CI.