At a glance
- Availability: Experimental (how to enable).
- Auth: API key.
- Connection: The key from
STACKIT_SERVICE_ACCOUNT_TOKENis sent as theBearerprefixedAuthorizationheader. - Docs: https://docs.stackit.cloud/platform/access-and-identity/service-accounts/authentication-flows/
Credentials
Set these per environment. See Connect an integration.| Variable | Required | Description |
|---|---|---|
STACKIT_SERVICE_ACCOUNT_TOKEN | Yes | Access token for a STACKIT service account, sent as Authorization: Bearer. Obtained via the key flow (signed JWT exchanged at the service-account token endpoint) or the STACKIT CLI; tokens are short-lived and must be refreshed Docs. |
Setup
- Get a STACKIT account and project: STACKIT is a B2B cloud by Schwarz Digital - request an organization at https://www.stackit.de, then create a project in the STACKIT Portal (https://portal.stackit.cloud).
- Create a service account with a key: In the Portal, open your project > Service Accounts, create one, assign it a role (e.g. reader), and create a service account key (key flow). The legacy static token flow was removed on 17 December 2025.
- Obtain a short-lived access token: Exchange a self-signed JWT (signed with the key’s private RSA key) at the service account token endpoint, or simply run the STACKIT CLI: ‘stackit auth activate-service-account —service-account-key-path key.json’ and export the resulting access token.
- Set the environment variable: Put the access token into your .env as STACKIT_SERVICE_ACCOUNT_TOKEN.
- Verify access: Run List Projects with member set to the service account’s email, then List Servers for a returned projectId in your region (e.g. eu01).
- Access tokens from the key flow are short-lived (refresh roughly every 10 minutes) - automate token renewal for long-running agents
- List Projects requires at least one filter: containerParentId (organization/folder) or member (email)
- The IaaS API v2 is the stable release; v1 is deprecated and will be removed after 1 March 2027
- IaaS URLs are region-scoped via the {region} path segment, e.g. eu01
Tools
| Tool | Access | Description |
|---|---|---|
| List Projects | Read | List STACKIT projects visible to the service account via the Resource Manager. At least one of containerParentId or member must be provided (use the service account’s email as member). |
| List Servers | Read | List IaaS servers in a STACKIT project and region |
| Get Server | Read | Get a single IaaS server in a project and region, including status, machine type, and availability zone |
| List Machine Types | Read | List available machine types (server flavors) in a project and region, useful before creating or resizing servers |
| Start Server | Write | Boot up a stopped server, or allocate it again if it was deallocated (returns 202 Accepted; completes asynchronously) |
| Stop Server | Write | Stop a server (returns 202 Accepted; completes asynchronously). Note: a stopped server remains on the hypervisor and is still charged full price for its attached resources |
| Reboot Server | Write | Reboot a server (returns 202 Accepted; completes asynchronously); soft reboots ask the OS to shut down gracefully, hard reboots power-cycle |
Example prompts
- List my STACKIT projects, then list the servers in the project and region I name, with status and machine type.
- Show me the STACKIT machine types available in my project and region and recommend one for a small web service.