AI Deploy - Accessing your app with tokens

Learn about the creation of application tokens for AI Deploy.

Requirements

• A Public cloud project
• Access to the OVHcloud Control Panel
• A running AI Deploy app (the deployed app in this guide uses the Docker image infrastructureascode/hello-world)

Instructions

Adding labels to an App

Tokens are scoped based on labels added to your AI Deploy app. You can view, add, and delete tags in the General information panel of your app's Dashboard tab.

In this case, we add the label group=A to the AI Deploy app. A set of default labels is added to all AI Deploy apps:

• ovh/id, whose value is the ID of the AI Deploy app
• ovh/type with value app, the type of AI resource

Generating tokens

From the AI Dashboard page, you access the tokens management page by clicking the Tokens tab. To add a new token, click + Create a token.

Read token

Two types of roles can be assigned to a token:

• AI Platform - Read-only
• AI Platform - Operator

A Read-only token will only grant you the right to query the deployed app, while an Operator token would also allow you to manage the AI Deploy app itself.

Let us create a token for the AI Deploy apps matching the label group=A with read-only access in the US-EAST-VA cluster. To create an AI Deploy app token, we need to specify three parameters:

• The token scope is specified through label selectors, and a token will be scoped over any app matching the set of label selectors. In this case, group=A
• The token role: AI Reader
• The region (cluster in which the AI Deploy apps): Virginia

Fill out the form and click Generate.

Upon success, you will see the newly generated token in a pop-up window.

Save the token string for later use. The token is only displayed once; make sure to save it before leaving the page, or you will need to regenerate the token.

This newly generated token provides read access over all resources tagged with the label group=A, including the ones submitted after the creation of the token.

Operator token

An operator token grants read access along with management access for the matching apps. This means that you can manage the AI Deploy app lifecycle (start/stop/delete) using either the CLI (more info here) or the AI Training API by providing this token.

This Operator token will be scoped on a specific AI Deploy app, and we will use the default ovh/id label to do so (since it is reserved, there is only one AI Deploy app that can match this label selector).

• Token scope: ovh/id=4c4f6253-a059-424a-92da-5e06a12ddffd
• The token role: AI Training - Operator
• The region: US-EAST-VA

Fill out the form and click Generate.

Additional information about the use of a token to manage an AI Training resource can be found here.

Using a token to query an AI Deploy app

With the token we generated in the previous step, we will now query the app. For this demonstration, we deployed a simple Hello World app that always responds Hello, World!.

You can get the access URL of your app in the details of the AI Deploy app above the Tags.

Browser

When accessing the AI Deploy app via its URL in your browser, you will reach a Login page:

To use the token to access this app, you can click on Login with token. Fill in your token in the dedicated field and click Connect.

You now land on the exposed AI Deploy app service:

Code integration

You can also directly CURL the AI Deploy app using the token as an Authorization header:

export TOKEN=<your-token>
curl "https://<your-app-id>.app.<your-app-region>.ai.cloud.ovh.us" -H "Authorization: Bearer $TOKEN"

> Hello, World!

Token lifecycle

Once a token is created, you can either regenerate the token or delete it.

Regenerating a token

When creating a token, the actual token string is only displayed once upon creation. It is not possible to retrieve the actual token afterward, so make sure to save it when creating a new one.

If you lost the token or if it leaked and you need to invalidate the token, you can generate it again. This causes the existing token to expire.

From the list of tokens, click on the more options ... button and select Regenerate:

Deleting a token

If you simply need to invalidate the token, you can delete it using the same action menu to regenerate a token. This will invalidate the existing token.

From the list of tokens, click on the more options ... button and select Delete.

Go further

For more information and tutorials, please see our other AI & Machine Learning support guides or explore the guides for other OVHcloud products and services.

If you need training or technical assistance to implement our solutions, contact your sales representative or click on this link to get a quote and ask our Professional Services experts for a custom analysis of your project.