DigitalOcean

DigitalOcean

This connector works with one DigitalOcean team through the API v2 (https://api.digitalocean.com/v2) with a personal access token: account, balance and invoices, Droplets (with power actions, snapshots and CPU and bandwidth metrics), App Platform apps with their deployments and logs, managed databases, Kubernetes clusters, volumes, DNS domains and records, firewalls and load balancers.

Setup (about 3 minutes)

1. In the DigitalOcean control panel open API, Tokens (https://cloud.digitalocean.com/account/api/tokens) and click Generate New Token. The token belongs to the team selected at the top of the control panel.
2. Pick an expiry and the scopes. Custom Scopes is the safest choice: read access for account, billing, droplet, app, database, kubernetes, block_storage, domain, firewall, load_balancer, monitoring, snapshot and actions; add droplet update for power actions and snapshots, app update for deployments, and domain create and update for DNS changes. Read Only covers every read here and refuses all changes. Avoid Full Access: it can also destroy resources.
3. Copy the token (it starts with dop_v1_ and is shown once) into DIGITALOCEAN_TOKEN. It is sent as Authorization: Bearer <token>.
4. Check the setup with digitalocean_get_account.

Changes affect running infrastructure: confirm first. digitalocean_power_droplet (power on, clean shutdown, hard power off, reboot, power cycle), digitalocean_snapshot_droplet (billed storage), digitalocean_create_app_deployment (rebuild and redeploy), digitalocean_create_domain_record and digitalocean_update_domain_record (live DNS) all change things people rely on. Before each call, show the user the resource and the change and wait for their yes. digitalocean_delete_domain_record is installed switched off. Destroying Droplets, apps, databases, clusters or volumes is not offered at all.

Secrets stay in DigitalOcean. Database tools return host and port but never passwords, connection strings or certificates; app tools leave out environment variables; Kubernetes tools return no kubeconfig.

How to work

1. Overview: digitalocean_get_account, digitalocean_get_balance, digitalocean_list_invoices.
2. Droplets: digitalocean_list_droplets, digitalocean_get_droplet; actions with digitalocean_power_droplet or digitalocean_snapshot_droplet, then poll digitalocean_get_action until completed; digitalocean_list_droplet_snapshots. Load: digitalocean_get_droplet_cpu_metrics and digitalocean_get_droplet_bandwidth_metrics (times in Unix seconds).
3. Apps: digitalocean_list_apps, digitalocean_get_app, digitalocean_list_app_deployments, digitalocean_get_app_deployment (failed steps and reasons), digitalocean_get_app_logs_url and digitalocean_get_app_deployment_logs_url (temporary links to the log files), digitalocean_create_app_deployment.
4. Data: digitalocean_list_databases, digitalocean_get_database, digitalocean_list_database_replicas; digitalocean_list_kubernetes_clusters, digitalocean_get_kubernetes_cluster; digitalocean_list_volumes.
5. Network: digitalocean_list_domains, digitalocean_list_domain_records, digitalocean_create_domain_record, digitalocean_update_domain_record; digitalocean_list_firewalls, digitalocean_get_firewall; digitalocean_list_load_balancers, digitalocean_get_load_balancer.

Ids: Droplets, actions and DNS records have numeric ids; apps, databases, clusters, volumes, firewalls and load balancers have UUIDs. Regions are slugs such as fra1 or nyc3.

Paging: lists take per_page (up to 200) and page; meta.total is the number of results and next_page is present while there are more.

Common errors

• 401 Unable to authenticate you: the token is wrong, expired or revoked.
• 403: the token lacks the scope for this call (for example billing:read for the balance, or an update scope for a change). Generate a token with that scope.
• 404: no such resource in this team.
• 422: a value is invalid, e.g. a Droplet that is already off, or a DNS record that conflicts with another.
• 429: more than 5,000 requests per hour or 250 per minute; wait.

Out of scope here: creating or destroying Droplets, apps, databases, clusters, volumes, firewalls and load balancers, resizing, changing app settings and environment variables, database users and passwords, Spaces object storage, container registry, Functions, GenAI and reserved IPs.