Cloudways documents API Access Tokens for a webhook-triggered Git deployment, but its documented GitHub Actions deployment uses SSH—not an access token. These are separate approaches. The available Cloudways documentation does not establish the current API v2 endpoint, request fields, or token permission needed for a direct Actions-to-API workflow, so avoid copying unverified API code. For an Actions-driven deployment, use Cloudways’ documented SSH release pattern; use the token-based webhook flow when its server-side design fits your needs.
Choose the deployment architecture first
A Cloudways API Access Token is not interchangeable with the SSH private key used by the documented GitHub Actions release workflow. In Cloudways’ webhook design, a Git provider calls a secured script on the application; that script authenticates to Cloudways and asks it to pull a repository branch. In the separate Actions design, the GitHub runner connects to the server over SSH and performs release steps.
As an Amazon Associate I earn from qualifying purchases.
| Approach | Trigger and deployment actor | Main credential | Release method | Trade-off |
|---|---|---|---|---|
| Cloudways webhook with API token | A Git provider sends a webhook; a server-side script calls the Cloudways API, and Cloudways pulls the branch. | Cloudways API Access Token plus a separate webhook secret. | Git pull into the configured deployment path. | Fewer runner-side release steps, but requires a secured reachable webhook and protected server-side configuration. |
| GitHub Actions with SSH | An Actions workflow runs on configured branch events; the runner connects to the Cloudways server. | Dedicated SSH private key stored as an Actions secret; its public key is trusted by the server. | Versioned release directory, shared persistent files, and a symlink switch. | More control over build and release sequencing, but requires SSH-key management and server-side release setup. |
These are architectures described in documentation, not measured performance results. Cloudways describes the SSH method as a zero-downtime pattern; that label is not an independently verified downtime guarantee.
What the documented token-based webhook does
Cloudways’ webhook guide, dated July 29, 2026, describes this sequence: push code to a Git repository, let the Git provider send a webhook, validate that request in a server-side script, then have the script make an authenticated Cloudways API request that triggers a pull of the selected branch. Cloudways says new integrations should use API Access Tokens rather than the legacy API Key.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Prerequisites for Cloudways’ webhook guide
- A Cloudways account you own and an application on Cloudways Flexible.
- Git deployment configured for the application, with the application’s SSH public key added at the Git provider so the server can access the repository over SSH.
- Repository settings access and the ability to create files through SSH or SFTP.
- A server ID, application ID, SSH repository URL, branch name, and, if needed, a deployment path. An empty path uses the default
public_htmldirectory.
Token handling in that design
Create the token in Cloudways API Integration, choose an expiration, and select Limited Access if it includes the required Git operation. Use Full Access only if Limited Access does not support that operation. Cloudways says the complete token is displayed once, so copy it at creation and store it securely. Its guide warns against exposing the token in public repositories, client-side code, public files, support tickets, chat, screenshots, or webhook URLs. The guide’s own implementation stores configuration outside public_html; that server-side PHP pattern is not a reason to place a token in a GitHub workflow file.
Cloudways also recommends a dedicated token, review and rotation, and revocation when the workflow is retired. If a token expires or is revoked, authentication stops until a replacement is created and configured.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What Cloudways documents for GitHub Actions
Cloudways’ zero-downtime deployment guide describes an Actions workflow that monitors the main and staging branches, connects to the server over SSH, prepares a timestamped release directory, reuses shared configuration and uploads, and switches a symlink to activate the release. The guide calls for a dedicated SSH key pair: put the public key on the Cloudways server and store the private key in GitHub repository Actions secrets.
This is evidence for an SSH-driven Actions architecture, not for a direct Actions-to-Cloudways API v2 workflow authenticated by an Access Token. The guide also includes API calls for follow-on server operations, but the documented material here does not verify that those calls use the newer token scheme.
Rank #3
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
For Cloudways Flexible applications, first follow the official Git deployment setup guide to configure repository access and Git deployment. Then use the SSH release design if Actions must control the release sequence.
Why a direct token-based Actions workflow is not copy-paste-ready
A reliable direct workflow needs the current API v2 authentication method, the Git deployment endpoint, its request fields, and the permission scope required by a Limited Access token. Those details are not established by the reviewed Cloudways documentation, so an endpoint or YAML example would be guesswork.
Rank #4
- FIDO2 Certified Passkey Authentication: Officially FIDO2 certified for secure, passwordless login on supported platforms. Use modern passkeys with hardware-backed protection. Please verify your intended service supports FIDO2 hardware keys before purchase.
- Precision Fingerprint Sensor: Built-in high-accuracy biometric fingerprint sensor ensures fast, convenient authentication while preventing unauthorized access. No PIN reuse, no shared secrets—only your fingerprint unlocks the key.
- Strong Hardware 2FA/MFA Security: Enhances account protection with physical-presence and biometric verification, helping defend against phishing, credential theft, and account takeovers.
- USB-C Wired Compatibility (No NFC): Designed for stable USB-C authentication on desktops and laptops, including Windows, macOS, and Linux systems. Ideal for users and enterprises that prefer wired-only security keys.
- Durable Aluminum Shield, Portable Design: Features the same precision aluminum protective shield for long-term durability. Compact, lightweight, battery-free, and network-free-built for everyday carry and professional environments.
Cloudways’ API v1 documentation says that v1 reached end of life on March 31, 2026. Treat it as a migration warning, not as authority for a new 2026 implementation. Before writing API calls into Actions, confirm the current v2 endpoint, authentication, payload, and token scope in Cloudways’ current documentation.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Also avoid adopting a third-party action solely because it appears in the GitHub Marketplace Cloudways API Git Action. Its listed configuration asks for an account email and legacy API Key, while Cloudways says not to create new integrations using that old key. Do not use it for an Access Token workflow unless its maintainer has documented current token support.
Best Value
![FIDO U2F Security Key, Thetis [Aluminum Folding Design] Universal Two Factor Authentication USB (Type A) for Extra Protection in Windows/Linux/Mac OS, Gmail, Facebook, Dropbox, SalesForce, GitHub](https://m.media-amazon.com/images/I/414cv-4SxrL._SL160_.jpg)
- Protect Online Account - Offer a strong factor authentication to your online account. Never lose your accounts through password theft, phishing, hacking or keylogging scams.
- Universal Compatibility - The Thetis U2F key can be used on any websites which support U2F protocol with the latest Chrome installed on your Windows, Mac OS or Linux. (Important Note: Not compatible with any email clients including Apple Mail, Mozilla Thunderbird or Microsoft Outlook)
- FIDO-U2f-Certified - Safety is our priority. Certified by world's largest Ecosystem for Standards-based, interoperable Authentication. Only support U2F protocol (No UAF or OTP). Provide low-cost and simple solution with high security.
- Extremly Durable - Designed with a 360° rotating metal cover that shields the USB connector when not in use. Also, crafted from a durable aluminum alloy to protect the Key from drops, bumps and scratches.
- Portable Design - Compact, ultra-portable design allows you to take your FIDO key anywhere you need it.
Secure and operate the workflow
- Create a dedicated deployment credential and grant only the permissions needed for the Git operation, if the current token selector offers an appropriate Limited Access scope.
- Keep API tokens and SSH private keys in GitHub Actions secrets or another protected secret store—not in committed workflow text, application files served publicly, logs, screenshots, or URLs.
- Restrict production secret access to intended branches and environments. Configure a production environment and approval gate when appropriate.
- Use concurrency controls to prevent overlapping production deployments when simultaneous releases could conflict.
- Plan token rotation and replacement before expiration; revoke credentials that are exposed or no longer needed.
- Run build and test steps before deployment, then validate the running application after release. GitHub documents event triggers, environments, secret and branch restrictions, approval gates, and concurrency in its continuous deployment guide.
GitHub notes that OpenID Connect can replace stored long-lived cloud credentials when the cloud provider supports it. The reviewed Cloudways material does not establish OIDC support for this deployment use case, so do not assume it is available.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
