# How to rotate a Hetzner Cloud API token

> Reissue a Hetzner Cloud API token: generate a second token in the same project with the same permission, switch your tools, test it, then delete the old token.

URL: https://crunu.com/rotate/hetzner
Language: en
Updated: 2026-10-30

Open the project in Hetzner Console, generate a second API token with the same permission as the old one, switch your tools to it, check a request, and then delete the old token. The two tokens work in parallel while you switch, so servers and pipelines keep running. Tokens are bound to the project they were created in, so the replacement must come from the same project ([Hetzner docs](https://docs.hetzner.com/cloud/api/getting-started/using-api/)). Hetzner's documentation doesn't say how quickly a deleted token stops working, so the last step includes checking for yourself.

Crunu doesn't generate or delete Hetzner tokens, and it has no Hetzner integration. It finds which Hetzner values a departing person could read, keeps the new token as a new version of the environment, and passes it to the tools that manage your project.

*Figure: Timeline of rotating the Cloud API token. Step 1: a new key is issued while the old one keeps working. Step 2: every place that uses the key is updated, with no downtime because both keys work. Step 3: the old key is revoked. The provider doesn’t document how fast a revoked key stops working.*

## A token is a key to a whole project

A Hetzner Cloud token has very few settings, which is exactly why its reach is wide:

- **Project.** Each token belongs to one project and works only there. Hetzner advises creating a separate token for each project. Since the token alone decides which project a request runs in, a mix-up between two tokens means changes land in the wrong project.
- **Permission.** There are two levels ([generating a token](https://docs.hetzner.com/cloud/api/getting-started/generating-api-token/)). **Read** allows only GET requests. **Read & Write** allows GET, DELETE, PUT and POST, so it can change or delete anything the API manages in that project.
- **No expiry and no second look.** The documentation describes no expiry setting, and once you close the window after creating a token, you can't view it again.

With no finer scopes available, your main controls are the project boundary and the number of tokens. Keep production in its own project, give each tool its own token, and use **Read** for anything that only watches, such as monitoring. A departure or a leak then touches one token in one project.

## Reissue without downtime

1. In Hetzner Console, open the project and go to **Security**, then **API tokens**, and choose **Generate API token**. Enter a description that names the tool using it, choose **Read** or **Read & Write**, and copy the token before closing the window.
2. Save it in Crunu as `HETZNER_CLOUD_TOKEN` in the environment for that project, for example `data-pipeline / production`. Each save adds a version to the environment's history, with the author and time.
3. Switch every tool that manages the project. Terraform runs and deploy scripts launched with `crunu run` read the latest version at start; a long-running controller started with `--restart on-change` restarts on its own.
4. Send a read request with the new token, like the one below, and make sure it lists the resources of the right project.
5. Delete the old token: in the same project, open **Security**, **API tokens**, select the token and delete it. A deleted item in Hetzner Console can't be restored. Then watch the tools for a while, and if one starts failing, it was still on the old token.

```sh
crunu run --env data-pipeline/production -- sh -c \
  'curl -s https://api.hetzner.cloud/v1/servers -H "Authorization: Bearer $HETZNER_CLOUD_TOKEN"'
```

The token travels in the `Authorization: Bearer` header, as in Hetzner's own examples. Running the request through `crunu run` keeps the value out of your shell history. Keeping one Crunu environment per Hetzner project mirrors the token boundary: the production token never sits next to the token of a staging project, people get access to each separately, and a reissue touches exactly one environment.

## When to reissue a Hetzner token

- **A departure.** Reissue every Read & Write token the person could read, starting with production projects, and end their access to Hetzner Console. In Crunu, removing the person produces a reissue checklist of the values they received, by name.
- **A leak.** Delete the leaked token first and accept that its tools stop, then generate and deploy the replacement. A Read & Write token can delete servers and volumes, so a short outage is the cheaper side of the trade. Afterwards, check the project for resources you don't recognize.
- **A schedule.** Since nothing in Hetzner's documentation makes a token expire, nothing forces a reissue. Set your own interval, and use each round to delete tokens nothing uses.

[What to rotate when a developer leaves](https://crunu.com/guides/developer-offboarding-secret-rotation) covers the order for a full departure, including access to the servers themselves, and the [offboarding checklist](https://crunu.com/tools/offboarding-checklist) builds the list for your stack. Creating and deleting tokens is done in Hetzner Console ([deleting a token](https://docs.hetzner.com/general/billing-and-account-management/cancellation/cancellations-hetzner-console/)); Crunu holds the new value and the record of when it changed.

## FAQ

### Can one Hetzner Cloud token work in several projects?

No. Each API token is bound to the project it was created in and can't be used for other projects. Hetzner recommends a separate token for each project, so a reissue happens project by project.

### Do Hetzner Cloud API tokens expire?

Hetzner's documentation describes no expiry setting for Cloud API tokens, so treat a token as valid until you delete it. Plan regular reissues yourself, and delete tokens no tool uses any more.

### What can a Read & Write token do?

It may send GET, POST, PUT and DELETE requests, so it can make any change the API allows in its project, including deleting resources. A Read token is limited to GET requests.

### Does Crunu reissue Hetzner tokens?

No. Crunu doesn't call the Hetzner API or Console. It shows which Hetzner values a departing person received, stores the new token as a new environment version and passes it to your tools through crunu run.

## Sources

- [Hetzner Docs: Generating an API token](https://docs.hetzner.com/cloud/api/getting-started/generating-api-token/) (accessed 2026-10-30)
- [Hetzner Docs: Using the API](https://docs.hetzner.com/cloud/api/getting-started/using-api/) (accessed 2026-10-30)
- [Hetzner Docs: Cancellations on Hetzner Console](https://docs.hetzner.com/general/billing-and-account-management/cancellation/cancellations-hetzner-console/) (accessed 2026-10-30)