Account
Integrations
Connect GitHub, cloud providers (Hetzner, DigitalOcean, Vultr, Linode, AWS) and DNS providers (Cloudflare, Route 53, DigitalOcean, Hetzner).
Integrations live under Settings → Integrations. Every token and key is encrypted with your organization's key and never shown again.
GitHub
Settings → GitHub → Connect GitHub installs the Zefily GitHub App on your account or organization. GitHub asks which repositories the app may read; Zefily gets read-only access to their contents, with tokens that last one hour. Connect more accounts with Connect another account; Disconnect removes one.
How it is used:
- Connect an account and choose the repositories (you can change the list on GitHub any time).
- Open a server → Sites → your site → Deploy and pick the account and repository from the list — no deploy key needed.
- Turn on push to deploy: every push to the site's branch deploys it, and GitHub shows the deploy status on the commit.
See Git deploys.
Cloud providers
Settings → Cloud providers connects provider accounts so Zefily can create, power-cycle, snapshot and delete servers there. Enter a Name and an API token with read and write access:
| Provider | Where to create the token |
|---|---|
| Hetzner Cloud | Cloud Console → your project → Security → API tokens → Generate (Read & Write) |
| DigitalOcean | API → Tokens → Generate New Token with Read and Write (or custom scopes for droplets) |
| Vultr | Account → API → Enable API. Vultr keys have full access: restrict them to our gateway IP there |
| Akamai Linode | Profile → API Tokens → Personal Access Token with Linodes: Read/Write |
| AWS EC2 | An IAM user with the Zefily EC2 policy, then an access key; enter ACCESS_KEY_ID:SECRET_ACCESS_KEY |
The token is verified when you connect it. Then Servers → Add server offers the account's regions, sizes and systems — see Connect a server. The provider bills the servers as usual.
DNS providers
Settings → DNS providers gives Zefily API access to your DNS for certificates through DNS-01: wildcard aliases, and sites not reachable on port 80 (behind a proxy).
| Provider | Credentials |
|---|---|
| Cloudflare | My Profile → API Tokens → Create Token → "Edit zone DNS" template, limited to the zones you need |
| Amazon Route 53 | An IAM user with route53:ChangeResourceRecordSets and route53:GetChange on the hosted zone, plus route53:ListHostedZonesByName; access key, secret, optional region and hosted zone id |
| DigitalOcean | API → Generate New Token with the domain scopes (read, create, delete) |
| Hetzner DNS | DNS Console → API tokens → Create access token |
Select the DNS provider in a site's Domain validation — see HTTPS and certificates. The server keeps the key, sealed for it, to renew on its own.
Notifications
Slack, Discord, Telegram and signed webhooks are set up under Settings → Notifications — see Notifications and webhooks.
Updated October 18, 2026