--- title: "AI Deploy - Accessing your app with tokens" description: "Learn about the creation of application tokens for AI Deploy." url: https://docs.us.ovhcloud.com/en/public-cloud/ai-machine-learning/ai-deploy-tokens lang: en --- > For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt. # AI Deploy - Accessing your app with tokens **Learn about the creation of application tokens for AI Deploy.** This is particularly useful when you want to make your app accessible to others without sharing your username and password. Moreover, using tokens facilitates the integration of your app with other services or scripts, such as those using curl, allowing for a more automated and flexible interaction with your AI Deploy application. In this tutorial, we will create and assign tokens to a basic AI Deploy app, running the [infrastructureascode/hello-world](https://hub.docker.com/r/infrastructureascode/hello-world) Docker image. **Note:** AI Deploy is covered by **[OVHcloud Public Cloud Special Conditions](https://us.ovhcloud.com/legal/service-specific-terms/)**.   ## Requirements - A **Public cloud** project - Access to the [OVHcloud Control Panel](https://manager.us.ovhcloud.com/)   ## Instructions By default, the following two labels are automatically added to each AI Deploy application: - `ovh/id` whose value is the ID of the AI Deploy app - `ovh/type` whose value is `app`, the type of AI resource **Note:** These labels are prefixed by `ovh/`, meaning these are reserved by the platform. These labels will be automatically overwritten by the platform if you attempt to redefine them during submission. They won't be displayed in the manager UI. In addition to these default labels, you can **create new ones** to further customize and secure your application access.   ### Adding labels to an App Tokens are scoped based on labels added to your AI Deploy app. To scope a token, you must add a label to your AI Deploy app. This can be done either during the app creation process or after the app is deployed. You can add multiple labels by repeating the following process.   #### Adding a label during app creation To add a label when creating an AI Deploy app, access the `Advanced Configuration` step in the app creation process. This section allows you to specify a custom Docker command, the mounted volumes, and **the app labels**. From this last sub-section, you can add a key-value pair. The key is the label identifier (e.g., `group`), while the value is the corresponding value assigned to this key (e.g., `A`). In this tutorial, we use the example `group=A` as the label of the AI Deploy app: Once created, all the labels of an AI Deploy app are listed on the app details, in the **Labels** panel:   #### Adding a label to an existing app If your app is already deployed, you can still add or update labels at any time using the Control Panel (UI) or the `ovhai` CLI. ##### Via the OVHcloud Control Panel Navigate to the **AI Deploy** section where all your apps are listed. **Click the name of your app** to open its details page. Locate the **Labels** section. Enter the key-value pair and click `+` to add the label to your app. After saving, the added label will be visible in the **Labels** section of the app details. ##### Via the ovhai CLI To follow this section, make sure you have installed the [ovhai CLI](https://docs.us.ovhcloud.com/en/public-cloud/ai-machine-learning/cli-install-client.md) on your computer or on an instance. You can also add labels to an existing app using the `ovhai` CLI. Run the following command: ```console ovhai app set-label ``` Replace with the unique identifier of your app (found in the app details or by running `ovhai app ls`). Also, substitute in your desired key and value pair. For example: ```console ovhai app set-label a8318623-8357-48b4-bd3b-648c3e343ec9 group A ``` This command adds the label `group=A` to the app with ID `a8318623-8357-48b4-bd3b-648c3e343ec9`. You can verify app labels by running `ovhai app get `. Labels will be displayed at the top of app details, in the _Labels_ field.   ### Generating tokens From the `AI Dashboard` page, you access the tokens management page by clicking the `Tokens` tab. To add a new token, click `+ Create a token`. Two types of roles can be assigned to a token: - **AI Platform - Reader**: allows only querying the app - **AI Platform - Operator**: allows querying and full lifecycle management (start/stop/delete)   #### Read token Let us create a token for the AI Deploy apps matching the label `group=A` with read-only access in the US-EAST-VA cluster. To create an AI Deploy app token, we need to specify four parameters: - **Token name**: used for token identification, management only. - **Label selector**: determines which apps the token applies to (e.g., `group=A`). - **Role**: choose from: - `AI Reader`: read-only - `AI Operator`: read & manage - **Region**: e.g., `Virginia` Fill out the form and click `Generate`. After completing the form, click `Generate` to confirm the token creation. **Warning:** **NOTE:** You will then receive the value of your new token, which you must **carefully save**, as its value is only displayed once. If you lose the token value, you will need to [regenerate it](#regenerating-a-token). This newly generated token provides read access over all resources tagged with the label `group=A`, including the ones submitted after the creation of the token. If you prefer working from the command line, you can generate the same token using the `ovhai` CLI: ```console ovhai token create reader-token --role read --label-selector group=A ```   #### Operator token An operator token grants read access along with management access for the matching apps. This means that you can manage the AI Deploy app lifecycle (start/stop/delete) using either the CLI (more info [here](https://docs.us.ovhcloud.com/en/public-cloud/ai-machine-learning/cli-install-client.md)) or the [AI Training API](https://us-east-va.ai.cloud.ovh.us/) by providing this token. The equivalent CLI command is: ```console ovhai token create operator-token --role operator --label-selector group=A ``` You can also scope a token to a specific app using the `ovh/id` label and the app’s ID as its value. This label is added automatically by default, as explained [above](#instructions), and because it is reserved, it will uniquely match only one app.   ### Using a token to query an AI Deploy app With the token we generated in the previous step, we will now query the app. For this demonstration, we deployed a simple Hello World app that always responds `Hello, World!`. You can get the access URL of your app in the details of the AI Deploy app above the **Tags**.   #### Browser When accessing the AI Deploy app via its URL in your browser, you will reach a Login page: To use the token to access this app, you can click on `Login with token`. Fill in your token in the dedicated field and click `Connect`. You now land on the exposed AI Deploy app service:   #### Code integration You can also directly CURL the AI Deploy app using the token as an `Authorization` header: ```bash export TOKEN= curl "https://.app..ai.cloud.ovh.us" -H "Authorization: Bearer $TOKEN" > Hello, World! ```   ### Token lifecycle Once a token is created, you can either regenerate the token or delete it.   #### Regenerating a token When creating a token, the actual token string is only displayed once upon creation. It is not possible to retrieve the actual token afterward, so make sure to save it when creating a new one. If you lost the token or if it leaked and you need to invalidate the token, you can generate it again. This causes the existing token to expire. From the list of tokens, click on the _more options_ `...` button and select `Regenerate`:   #### Deleting a token If you simply need to invalidate the token, you can delete it using the same action menu to regenerate a token. This will invalidate the existing token. From the list of tokens, click on the _more options_ `...` button and select `Delete`.   ## Go further Browse all the [AI & Machine Learning guides](https://docs.us.ovhcloud.com/en/public-cloud/ai-machine-learning/landing-page-ai-machine-learning.md). Browse the rest of the [OVHcloud US documentation](https://docs.us.ovhcloud.com/en/index.md) for guides on our other products and services. Learn more about [AI & Machine Learning](https://us.ovhcloud.com/public-cloud/ai-machine-learning/) on the OVHcloud US website. If you need training or technical assistance to implement our solutions, contact your sales representative or click on [this link](https://us.ovhcloud.com/professional-services/) to get a quote and ask our Professional Services experts for a custom analysis of your project.