Hetzner Cloud integrationWhat it reads

What does MarshalCloud do with Hetzner Cloud?

• Read-only inventory: servers, volumes, load balancers, private networks and firewalls, with the edges between them.

Read-only is the default everywhere. A fix is drafted, priced and explained, and then waits for a person to approve it.

What MarshalCloud never does in Hetzner Cloud

• The token you connect with is stored encrypted, never shown back, and never handed to a build.
• The read token cannot create, change or delete anything in Hetzner. Fixes are a separate step: approval-gated cleanups, such as deleting an idle server after taking a snapshot or releasing an unused IP address, need a separate fix token you choose to add, a person approves each one, and none can be undone, because deleting is what stops the charge.

What it does not cover

• No spend figure is invented. Hetzner exposes prices per server type and one monthly invoice, not metered usage rows, so the spend pages say unavailable for a Hetzner account.
• No security posture checks run on Hetzner; that part of the console says unknown, never a pass.

How do you connect Hetzner Cloud?

1. 01Create a read-only API token in the Hetzner Cloud Console for the project.
2. 02Paste it into the Hetzner connection in MarshalCloud. It is verified with one read before it is saved.
3. 03The map fills in after the first read.

Questions about the Hetzner Cloud integration