---
title: Create Cloud Providers From The CLI
url: "/docs/locations/cloud-providers/create-from-cli/"
canonical_url: https://docs.blossom88.com/docs/locations/cloud-providers/create-from-cli/
markdown_url: https://docs.blossom88.com/docs/locations/cloud-providers/create-from-cli.md
summary: Use blossom cloud_provider:create to add cloud provider connections from
  YAML or JSON
categories:
- clouds
- cli
---

# Create Cloud Providers From The CLI

Use `blossom cloud_provider:create` to add cloud provider connections from a YAML or JSON payload.

    blossom cloud_provider:init

writes a starter Hetzner payload, cloud_provider.yml. `${HETZNER_API_TOKEN}`
reads the token from your environment; export it or replace it with your
credentials:

```yaml
cloud_provider:
  name: hetzner-production
  provider: hetzner
  credentials:
    api_token: ${HETZNER_API_TOKEN}
```

    blossom cloud_provider:create --data cloud_provider.yml
    blossom cloud_provider:create -d '{"cloud_provider":{"name":"hetzner-production","provider":"hetzner","credentials":{"api_token":"..."}}}'

Every payload uses the same `cloud_provider` resource envelope.

## Discover Providers

Run `blossom cloud_provider:types` to see which providers Blossom supports:

    blossom cloud_provider:types
    BLOSSOM_OUTPUT=json blossom cloud_provider:types

The JSON output is useful for scripts and tools. It includes provider keys,
required credential fields, credential check descriptions, and example payloads.

## AWS

```yaml
cloud_provider:
  name: aws-production
  provider: aws
  credentials:
    access_key_id: AKIA...
    secret_access_key: ...
```

Blossom checks AWS credentials by listing EC2 regions. The credentials need
permission for `ec2:DescribeRegions`.

## Azure

```yaml
cloud_provider:
  name: azure-production
  provider: azure
  credentials:
    tenant_id: ...
    subscription_id: ...
    client_id: ...
    client_secret: ...
```

Blossom checks Azure credentials by verifying subscription access. The service
principal should have Reader access to the subscription.

## GCP

```yaml
cloud_provider:
  name: gcp-production
  provider: gcp
  credentials:
    type: service_account
    project_id: ...
    private_key: ...
    client_email: ...
```

Blossom checks GCP credentials by listing compute zones. The service account
needs permission for `compute.zones.list`.

## DigitalOcean

```yaml
cloud_provider:
  name: digitalocean-production
  provider: digitalocean
  credentials:
    token: ...
```

Blossom checks the token by reading DigitalOcean account information. You can
also connect DigitalOcean through browser authorization in the Web UI.

## Hetzner

```yaml
cloud_provider:
  name: hetzner-production
  provider: hetzner
  credentials:
    api_token: ...
```

Blossom checks Hetzner credentials by listing datacenters. A read-only token is
enough for the credential check.

## Linode

```yaml
cloud_provider:
  name: linode-production
  provider: linode
  credentials:
    api_token: ...
```

Blossom checks Linode credentials by reading account information.

## Vultr

```yaml
cloud_provider:
  name: vultr-production
  provider: vultr
  credentials:
    api_token: ...
```

Blossom checks Vultr credentials by reading account information.

## Check Credentials

After creating a cloud provider, check the saved credentials:

    blossom cloud_provider:check --id cloud_provider-100

The command uses the same provider-specific credential check as the Blossom web
UI.