Authentication

The MCP server authenticates using your IONOS CLOUD API token and, for IONOS CLOUD Object Storage tools, your Object Storage credentials.

API token

IONOS_TOKEN is required for all tools. It authenticates requests to the Compute Engine, Cloud DNS, Billing, Certificate Manager, and Object Storage management APIs.

To generate an API token:

1

Log in to the DCD and go to Token Management

Log in to the DCD and navigate to Management > Token Management.

2

Generate and copy the token

Select Generate Token, set an expiry, and copy the token value.

Set an expiry that matches your use case: 24 hours for one-off queries, 7–30 days for persistent AI client setups, or longer for automated workflows. If the token expires during a session, tool calls will fail with authentication errors. Update the token in your configuration and restart the AI client. For more information, see FAQ.

Pass the token in your MCP client configuration:

{
  "mcpServers": {
    "ionoscloud": {
      "command": "/path/to/ionoscloud-mcp",
      "env": {
        "IONOS_TOKEN": "your-api-token"
      }
    }
  }
}

IONOS CLOUD Object Storage credentials

Object Storage data-plane tools (listing objects, reading bucket configuration, and checking access keys) require Object Storage credentials in addition to IONOS_TOKEN.

To generate Object Storage credentials:

1

Log in to the DCD and go to Access Keys

Log in to the DCD and navigate to Object Storage > Access Keys.

2

Generate and copy the credentials

Select Generate Key and copy the access key and secret key.

Add the credentials to your MCP client configuration:

{
  "mcpServers": {
    "ionoscloud": {
      "command": "/path/to/ionoscloud-mcp",
      "env": {
        "IONOS_TOKEN": "your-api-token",
        "IONOS_S3_ACCESS_KEY": "your-access-key",
        "IONOS_S3_SECRET_KEY": "your-secret-key"
      }
    }
  }
}

Warning: Never commit your API token or Object Storage credentials to version control. Use your operating system keychain or a secrets manager to store them securely.

Security best practices

• Use a dedicated token for the MCP server rather than your primary account token.
• Restrict the token to read-only permissions where your IONOS CLOUD account allows it.
• If you use a sub-user account, ensure the token has read access to each product you intend to query. Tokens with restricted scope return empty results or errors for out-of-scope resources.
• On macOS and Linux, restrict access to your configuration file after saving credentials:

  chmod 600 ~/Library/Application\ Support/Claude/claude_desktop_config.json

Token scope by product area

Use the table below to set minimum-privilege permissions when creating a dedicated MCP token. All operations are read-only in this release.

Product	Permission required	Tools covered
Compute Engine	Read access to Virtual Data Centers	All Compute Engine tools (50)
IONOS CLOUD Object Storage	Read access to Object Storage (management API)	Bucket listing, bucket configuration tools
IONOS CLOUD Object Storage (data-plane)	Object Storage access key + secret key (IONOS_S3_ACCESS_KEY, IONOS_S3_SECRET_KEY)	Object listing, object metadata, versioning
Cloud DNS	Read access to DNS	All DNS tools (14)
Billing	Read access to Billing / Usage	All Billing tools (15, including get_billing_focus_spec which needs no IONOS privilege)
Certificate Manager	Read access to Certificate Manager	All Certificate Manager tools (6)
Activity Log	ACCESS_ACTIVITY_LOG privilege on the token	All Activity Log tools (2)

For the narrowest possible scope, create a sub-user with access only to the products you intend to query and generate the token under that sub-user.