Hetzner — Setup

Overview

In this guide you will:

1. Create a new, dedicated Hetzner Cloud project for your VPN.
2. Generate a Read & Write API token inside that project.
3. End with the token, which you hand to the app in Hetzner — Key handoff.

The token is project-scoped: because you put it in a dedicated project, PhoenixVPS can only see and manage resources in that one project — never your other Hetzner servers.

---

Prerequisites

Before you start, make sure you have:

• A Hetzner Cloud account, and you are signed in to the Hetzner Cloud Console.
• The PhoenixVPS app installed on your device.

Identity verification required at signup

Hetzner is an EU provider with strict identity checks (KYC). Creating an account typically requires verifying your identity — often a photo ID plus a selfie. Allow extra time: a new account may not be able to create servers until that verification clears.

---

Step 1 — Create a dedicated project

In PhoenixVPS’s Hetzner Cloud panel, click Open Hetzner Console (this opens the Hetzner Cloud Console at the Projects page). Or go directly to https://console.hetzner.cloud/projects.

On the Projects page, click the + New project card. Give it a name such as PhoenixVPS and confirm.

What you see: The new project appears as a card alongside any existing projects.

Use a new project — do not reuse an existing one

The API token can only be scoped to a whole project, so a dedicated project is what keeps PhoenixVPS away from your other servers. Don’t generate the token inside a project that holds resources you care about.

---

Step 2 — Open the project’s API tokens page

Click your new project’s card to open it. The project Dashboard opens, with a menu down the left-hand side.

At the bottom of that left menu, click Security. The Security page opens with a row of tabs across the top:

SSH keys  ·  S3 credentials  ·  API tokens  ·  Certificates  ·  Members

Click the API tokens tab.

What you see: The API tokens list (empty in a new project) and a red Generate API token button in the top-right corner.

---

Step 3 — Generate a Read & Write token

Click Generate API token. A dialog titled Generate API token opens.

1. In the Description field, type a name you’ll recognise, such as PhoenixVPS.
2. Under Permissions, select Read & Write.

Why Read & Write: PhoenixVPS needs to create and delete the VPN server, not just read. A Read-only token will be accepted by Hetzner but the app will fail when it tries to start a server.

Click the Generate API token button in the dialog.

---

Step 4 — Copy the token

What you see: The dialog shows the full token once. It is a long string of letters and numbers.

Copy it now.

Shown only once

Hetzner displays the full token only at this moment. If you close the dialog without copying it, you cannot retrieve it — you would have to delete it and generate a new one. Do not paste it into chat, email, or any document; the only place it should go is the PhoenixVPS field in the next step.

---

Next step

Take the token to Hetzner — Key handoff to paste it into PhoenixVPS.