# Ensure API Credentials Are Not Granted Wildcard Access

- Source: https://support.icompaas.com/support/solutions/articles/a_1791826023205599-ensure-api-credentials-are-not-granted-wildcard-access
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [OVH Cloud](https://support.icompaas.com/support/solutions/c_1791819364512367) › [checks](https://support.icompaas.com/support/solutions/folders/f_1791819376721251)
- Last updated: 2026-10-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure OVHcloud API credentials are granted only the HTTP methods and API paths their tool needs, for example GET /cloud/project/\*, rather than full wildcard rules such as GET /\*, POST /\*, PUT /\*, and DELETE /\* that allow every action on every service.

**Rationale**

A credential with wildcard rights can read and change every service in the account, including billing, DNS, and IAM. If it leaks, the attacker gains the same full control. Limiting each credential to the paths and methods it needs means a leaked key can only affect a small part of the account.

**Impact**

-   Limits what a leaked credential can do
    
-   Enforces least privilege for automation
    
-   Tools may need new credentials with more specific rights
    

**Default Value**

When creating API keys, the Rights are chosen freely, and full wildcard rights can be granted.

**Pre-Requisites**

-   Access to the OVHcloud account
    
-   A list of the API paths each tool needs
    

**Test Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Identity, Security & Operations.
    
3.  Select API keys.
    
4.  Alternatively, use the OVHcloud API console at [https://eu.api.ovh.com/console/](https://eu.api.ovh.com/console/) (or your region's console). Run GET /me/api/credential/{credentialId} for each credential and review its rules.
    
5.  Flag any credential whose rules include a full wildcard path such as /\*.
    
6.  If any are found, follow the implementation steps.
    

**Implementation Steps**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Identity, Security & Operations.
    
3.  Select API keys.
    
4.  Select Create API key and, under Rights, add only the methods and paths the tool needs, for example GET /cloud/project/\*.
    
5.  Update the tool to use the new credential.
    
6.  Delete the wildcard credential.
    

**Backout Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Identity, Security & Operations.
    
3.  Select API keys.
    
4.  Create a new API key with the previous rights and update the tool if the new rights are not enough.
    

**Reference**

-   [https://help.ovhcloud.com/csm/en-gb-api-getting-started-ovhcloud-api?id=kb\_article\_view&sysparm\_article=KB0042784](https://help.ovhcloud.com/csm/en-gb-api-getting-started-ovhcloud-api?id=kb_article_view&sysparm_article=KB0042784)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.