AgentAura on Hetzner Cloud: Server, SSH Key and API Token 🔴

By the end of this guide you will have a Hetzner Cloud server that AgentAura can deploy onto: Ubuntu 24.04 on an x86 CPU, about 2 vCPUs and 4 GB of RAM, a public IPv4 address, and your own SSH key for logging in as root.

Hetzner is one of the two providers where AgentAura offers two ways in:

• My Server (steps 1 to 6) works in every AgentAura client: web, iPhone and iPad, Mac, Android, Windows and Linux. You create the server in the Hetzner Console and give AgentAura its address and a key.
• An API token (step 7). If your AgentAura app shows a Hetzner option (currently the Apple apps and the Windows app), you paste a Hetzner API token and the app creates the server in your own Hetzner project.

Either way, Hetzner bills you directly. Getting a Server for AgentAura explains the requirements behind each choice. The Hetzner Console changes from time to time, so labels may look slightly different from what we describe.

1. Create an account and a project

Register on Hetzner's accounts site, enter your contact details and a billing address, and confirm your email address through the link Hetzner sends. A phone number is optional. Hetzner asks you not to use a VPN while registering and, if possible, not to use a free email address: both make its fraud checks harder.

Before it processes an order, Hetzner may ask you to verify the account, either with a copy of a government-issued ID or with an advance payment from your own credit card. The Hetzner pages we checked (September 2026) do not describe a free trial; a server is billed from its first hour.

In the Hetzner Console, servers, keys and API tokens all belong to a project. Create one just for AgentAura, named agentaura for example, so nothing in it mixes with anything else you run.

2. Make an SSH key

Make a new key for this server only, with no passphrase (AgentAura has no passphrase field):

# macOS or Linux
mkdir -p ~/.ssh
ssh-keygen -t ed25519 -f ~/.ssh/agentaura -N "" -C "agentaura"

# Windows 10 or 11, in PowerShell. When asked for a passphrase, press Enter twice.
New-Item -ItemType Directory -Force "$HOME\.ssh" | Out-Null
ssh-keygen -t ed25519 -f "$HOME\.ssh\agentaura" -C "agentaura"

The overview guide explains the key rules in detail. Show the public key and copy it; you paste it into Hetzner in the next step:

cat ~/.ssh/agentaura.pub                   # macOS / Linux
Get-Content "$HOME\.ssh\agentaura.pub"     # Windows PowerShell

3. Create the server

Open your project, go to Servers and select Add server. Then:

• Location: the one nearest to you.
• Image: under OS images, Ubuntu 24.04. Not an App image: those come with software preinstalled, and AgentAura wants a fresh server.
• Type: a shared-vCPU x86 plan with about 2 vCPUs and 4 GB of RAM:

• Networking: keep both IPv4 and IPv6 ticked. Hetzner can build IPv6-only servers, and because a public IPv4 is billed separately, unticking it looks like a saving. AgentAura needs it.
• SSH key: add the public key you copied, name it agentaura, and make sure it is selected. Hetzner's docs say an SSH key cannot be added through the Console after the server exists.
• Firewalls, Backups, Volumes, Cloud config: leave empty.
• Name: agentaura.

Click Create & Buy now. When the server shows as running, its IPv4 address appears on the server page; clicking the address copies it.

4. Firewall and network

A Hetzner Cloud Firewall is optional, and the server only has one if you applied it. If you did not, there is nothing to change here.

If you use one, know that a firewall with no inbound rules blocks all inbound traffic. Give it one inbound rule: TCP port 22 from any address (0.0.0.0/0 and ::/0). Do not narrow it to your own IP: AgentAura connects over SSH from its own cloud, for the install and later for logs, restarts, reconnecting credentials, adding agents and updates. Leave outbound rules empty, which allows all outbound traffic, and open no other port: the agent is reached through an outbound Cloudflare Tunnel.

5. Log in once yourself

Wait a few minutes after the server starts: a new server may still be booting or running its first package upgrades, which lock apt. Then log in with your server's address:

ssh -i ~/.ssh/agentaura root@203.0.113.10
# Windows PowerShell: ssh -i "$HOME\.ssh\agentaura" root@203.0.113.10

Answer yes to the fingerprint question. At the root@ prompt, type exit.

On Ubuntu 22.04 and later, Hetzner disables root password login for servers created with an SSH key, so the key is your way in. If you created the server without a key, Hetzner emails a root password instead, and the first login with it makes you set a new one. Do that login yourself before giving AgentAura the password.

6. Fill in AgentAura

Choose My Server and enter:

Display the private key for copying:

cat ~/.ssh/agentaura                   # macOS / Linux
Get-Content "$HOME\.ssh\agentaura"     # Windows PowerShell

Copy everything, including the BEGIN and END lines, start the deployment and watch the output. The quick start covers the model credential you choose next.

7. Or let AgentAura create the server with an API token

If your AgentAura app shows a Hetzner option, it can create the server for you instead of steps 3 to 6. It needs a token from your project:

1. Open the agentaura project, go to Security and then the API tokens tab.
2. Select Generate API token and give it a description such as AgentAura.
3. Choose Read & Write. A Read token only allows reading, so the app could not create a server with it.
4. Copy the token right away. Hetzner shows it only once.

Paste it into AgentAura's Hetzner option and pick a size; the app currently offers two x86 sizes, 2 vCPU / 4 GB and 4 vCPU / 8 GB. The server appears in that project and Hetzner bills you for it.

Tokens belong to one project, which is why a separate project matters: this token can manage everything in agentaura and nothing outside it. Treat it like a password. If it leaks, delete it under API tokens and generate a new one.

8. Costs and cleanup

Hetzner bills a server by the hour, rounded up to full hours, with a monthly price cap, from creation until you delete it. Removing an agent in AgentAura does not delete the server, and neither does a failed deployment.

• Powered off still costs the full price. Hetzner bills a server "regardless of whether it is turned on or not", because its resources stay reserved.
• The IPv4 address is billed separately. A Primary IPv4 is billed until it is deleted, even when no server uses it. It goes with the server only if its auto delete setting is on, so after deleting the server, check Primary IPs in the project.
• Snapshots and Backups cost extra if you create them.

Common problems

• Connection timed out. A Cloud Firewall lacks the port 22 rule or only admits your IP, or the server was created without IPv4.
• Permission denied (publickey). The key was not selected at creation, you pasted the .pub file, or the key has a passphrase. The server is empty, so deleting it and creating a new one with the right key is quicker than repairing it.
• Password rejected. Servers created with an SSH key refuse root password logins over SSH. Use the key.
• The install stops on an apt lock. First-boot upgrades were still running. Wait and deploy again.
• The Hetzner option in AgentAura cannot create a server. The token is Read only, belongs to another project, or your account still needs verification.

Official Hetzner pages we used: Creating a Server · Generating an API token · Cloud Servers FAQ · Billing FAQ