Oracle Cloud Infrastructure Documentation

Creating an Application

Applications define managed runtime settings for hosted deployments, including scaling, managed storage, networking, and authentication. This task explains how to create an application by using the Oracle Cloud Console in the OCI Generative AI service.

On the Applications list page, select Create application. If you need help finding the list page, see Listing Applications.

Basic Information

  1. Enter a name for the application.
    Start the name with a letter or underscore, followed by letters, numbers, hyphens, or underscores. The length can be 1 to 255 characters.
  2. (Optional) Enter a description for the application.
  3. Select a compartment to create the application in. The default compartment is the same as the list page, but you can select any compartment that you have permission to work in.

Tags

  1. (Optional) Select Add tag and assign tags to this application. See Resource Tags.
  2. Select Create.

Scaling

  1. For Autoscaling, define how hosted deployments scale to handle load.
    • Minimum replicas

      The minimum number of replicas that must always be running. This value must be less than or equal to the maximum replicas value. Default is 1.

    • Maximum replicas

      The maximum number of replicas that can run. New replicas are added as load increases, up to this limit. Default is 3 and the maximum is 30. To disable autoscaling, set this value equal to Minimum replicas.

  2. Select a scaling metric.
    The service adds replicas when the selected metric exceeds the configured target, up to the maximum replicas value.
    • CPU utilization (%)

      Adds replicas when CPU utilization exceeds this percentage, up to the maximum replicas you set. Range: 50–95%.

    • Memory utilization (%)

      Adds replicas when memory utilization exceeds this percentage, up to the maximum replicas you set. Range: 50–95%.

    • Concurrent requests

      Adds replicas when concurrent requests exceed this value, up to the maximum replicas you set. Range: 1–500.

    • Requests per Second (RPS)

      Adds replicas when requests per second exceed the configured target, up to the maximum replicas you set.

Storage (Optional)

If deployments in the application need service-managed storage, you can enable OCI PostgreSQL, OCI Cache, or Oracle Autonomous AI Database.

Enable managed storage for hosted deployments associated with this application. Managed storage is created and managed by the service and is accessible only from the hosted deployment associated with this application. Connection details are provided to the container through environment variables.

If the application needs Managed storage, enable one of the following options.
  • OCI PostgreSQL

    Enable OCI PostgreSQL to provide a managed database for deployments in this application.

    For this option:
    • Enter the environment variable name that receives the OCI PostgreSQL connection URI. The service adds the connection string to the specified environment variable.
    • Storage: Select whether to create storage or use existing storage. If you select existing storage, the application shares the OCI PostgreSQL storage resource with other applications in the tenancy. Each application is assigned a dedicated database, and this application has permission to access only its dedicated database.
  • OCI Cache
    Enable OCI Cache to provide a managed cache for deployments in this application. For this option:
    • Enter the environment variable name that receives the OCI Cache connection URI.
    • Storage: Select whether to create storage or use existing storage.
  • Oracle Autonomous Database
    Enable Oracle Autonomous AI Database to provide a managed database for deployments in this application. For this option:
    • Enter the environment variable name that receives the Autonomous AI Database connection URI.
    In addition to the connection string, the service mounts the database user credentials to the following local files in the container:
    /mnt/secrets/adb/username
/mnt/secrets/adb/password

Environment

  1. (Optional) Enter one or more Environment Variables for the deployment as key-value pairs. For each variable, enter the environment variable name and its value. Add as many variables as the application needs.
  2. (Optional) For Vault environment variables, enter the following:
    • Variable name
    • Vault OCID
    • Vault key

    • The service adds the vault information to the container as a JSON file. Example JSON code:

      {
    "vaultId":<vault-ocid>,
    "key":<the secret in the vault>
}

Networking (Optional)

Select how deployments in this application route outbound traffic, and how clients access the deployment endpoint.

  1. For Networking, select one of the following options.
    • Default (service-managed)

      Allows outbound access to OCI services and the public internet through a service-managed network.

    • Custom (customer-managed)
      Routes outbound traffic through a VCN and subnet in the tenancy by using a private endpoint connection. This option is recommended for private, enterprise-integrated deployments. For this option, select the following:
      • VCN compartment
      • VCN
      • Subnet compartment
      • Subnet
      Note

      If you select custom networking, all egress traffic is routed to the VCN subnet. If the application also needs internet access, consider using a public subnet and configuring the route table. See Internet Gateway.
  2. Select whether the active deployment for this application is accessed through a public or private endpoint.
    • Public

      Accessible from outside the VCN.

    • Private

      Accessible only from within the VCN.

      Important

      You must use a Generative AI private endpoint. If you don't have one, create a Generative AI private endpoint.

      Select the following information:

      • Private endpoint compartment
      • Private endpoint

    After the application is created, you can access it through this private endpoint by using its FQDN or IP address. Example FQDN:

    https://<pe-name>.pe.inference.generativeai.<region>
.oci.oraclecloud.com/20251112/hostedApplications/{your_application_ocid}

Authentication

Select one of the following authentication methods:

  • Identity domain bearer token: Uses an OAuth 2.0 access token issued by an OCI IAM identity domain. The token is sent to the target service as a bearer token, and the service validates the token before accepting the request. As a prerequisite, perform the tasks in Setting up Authentication for Agentic Support.
  • OCI IAM: Uses OCI IAM request-signature authentication. Each request is cryptographically signed according to OCI API request-signing requirements.
Note

When using the API, use the CreateHostedApplication API for identity domain bearer token authentication with an InboundAuthConfig. To create an application that uses OCI IAM authentication, use the CreateHostedApplicationIam API with CreateHostedApplicationIamDetails. The OCI IAM API doesn't require an OAuth or IDCS configuration.

For Identity domain bearer token, perform the following steps:

Identity domain bearer token

  1. For Authentication type, select Identity domain bearer token.
  2. Select one of these options:
    • Select an existing identity domain

      Use the same identity domain in which you created the confidential integrated application in Step 2. Create an Application in the Identity Domain.

      • Identity domain compartment
      • Identity domain
    • Paste an identity domain URL

      Example: https://idcs-xxx.identity.oraclecloud.com:443

  3. For the identity domain, enter values for the following parameters:
    • Scope

      Specifies the actions that the access token is permitted to perform. Examples: user.read, email.

    • Audience

      Specifies the service or API that the access token is intended for. The target resource server accepts the token only when the audience claim matches that server.

      To find this value, open the identity domain Console and select the integrated application you created in Step 2. Create an Application in the Identity Domain. Select OAuth configuration, copy Primary audience, and paste it here.

      Examples:
      https://api.example.com
      https://my-service.internal
      urn:my-resource-server
      ocid1.resourceServer.oc1..xxxx

Enable Application Logs

Enable resource logging to track application activity, troubleshoot issues, and collect operational insights for hosted deployments.

  1. (Optional) Turn on Enable log.
  2. For Category, select genai-hosted-deployment-log or create a new log group.
  3. For Log group, select an existing log group or select Create new log group.
  4. Select the compartment that contains the log group.
  5. Enter a log name.
  6. (Optional) Under Advanced options, select a log retention period.
    The default retention period is 1 month (30 days).

Review and Create

Review the application settings, then select Create application.

Note

Application creation time depends on the resources that the service provisions for the application.

  • If managed storage is enabled, the service provisions a dedicated storage instance, which might take several minutes.

  • If custom networking is selected, the service provisions the required network bridging resources, which might also take several minutes.

Review the settings and select Create application.
Tip

After you create an application, you can view its details and perform other tasks, such as moving it to a different compartment, managing its tags, or deleting it. Use the Actions menu (three dots) in the Console to access these tasks. You can also create a deployment for the application from its detail page. For more information, see Listing Applications.