Docs / Cloud Accounts / Connect DigitalOcean Account

Connect DigitalOcean Account

Published · Last updated: June 2026 · 8 min read

Overview

CloudAIPilot connects to DigitalOcean using a Personal Access Token (PAT) — an API credential you generate from the DigitalOcean control panel. This gives CloudAIPilot programmatic access to provision and manage Droplets, Firewalls, and Volumes in your account.

You can revoke access at any time by deleting the token from your DigitalOcean API settings.

Security & PQC Note

A DigitalOcean PAT grants full API access to your account, so protecting it matters. The moment you paste the token into CloudAIPilot, it is encrypted at rest using Post-Quantum Cryptography (PQC) standards (ML-KEM-768). The plaintext token is never stored and cannot be viewed again in the CloudAIPilot UI.

Before You Begin

You will need:

  • A DigitalOcean account with Owner or Member access (tokens grant whatever level of access the generating user has)
  • Billing active on the account (required to create Droplets)

If your DigitalOcean account is on a team, tokens are scoped to the team by default. A token generated by a team member will have access to all of that team's resources.

Step-by-Step Guide

Step 1: Generate a Personal Access Token

  1. Log in to the DigitalOcean Control Panel.
  2. In the left sidebar, click API (under the account section near the bottom).
  3. On the Tokens tab, click Generate New Token.
  4. Fill in the token details:
    • Token name: CloudAIPilot
    • Expiration: We recommend 1 year. For stricter security, choose a shorter duration and set a calendar reminder to rotate before expiry.
    • Scopes: Select Full Access (both Read and Write). CloudAIPilot requires Write to provision and manage Droplets.
  5. Click Generate Token.
  6. Copy the token immediately — DigitalOcean only shows it once. If you leave the page without copying, you must generate a new token.

Can I use a scoped token? DigitalOcean supports custom scopes on tokens. A scoped token works with CloudAIPilot as long as it includes write access for: Droplet, Volume, Firewall, SSH Key. If any required scope is missing, the pre-flight check will tell you which permission is failing. Full Access is the simplest approach for most users.

Step 2: Connect in CloudAIPilot

  1. In CloudAIPilot, go to Cloud Accounts → Add Account → DigitalOcean.
  2. Paste the token into the Personal Access Token field.
  3. Click Test & Connect.
  4. CloudAIPilot performs a pre-flight check to verify the token has sufficient write permissions before saving. If the check fails, you will see a specific error — see the troubleshooting section below.

FinOps and Billing Data

DigitalOcean's API does not expose per-resource cost data the same way AWS or GCP do. As a result, the FinOps dashboard for DigitalOcean shows:

  • Available: Droplet-level cost estimates (based on Droplet size and region pricing)
  • Available: Invoice totals pulled from the billing API
  • Not available: Real-time per-resource tagged cost breakdown (DigitalOcean does not support cost allocation tags at the API level)

The same Personal Access Token is used for billing data — no additional credential is needed. For full per-resource attribution, see KB-08-02: Connect Billing Data Per Provider.

Token Expiry and Rotation

When your PAT expires, CloudAIPilot loses access to your DigitalOcean account and all operations (provisioning, monitoring, backups) stop working. You will not be warned automatically — the connection will simply start returning errors.

To rotate the token before it expires:

  1. Generate a new token in DigitalOcean (follow Step 1 above).
  2. In CloudAIPilot, go to Cloud Accounts → [your DigitalOcean account] → Edit.
  3. Paste the new token and click Save.
  4. Delete the old token from DigitalOcean.

See KB-01-06: Reconnect or Rotate Credentials Safely for the full rotation procedure.

Verifying a Successful Connection

After connecting, your DigitalOcean account appears in the Cloud Accounts list with a green Connected status. Navigate to Servers → Add Server — DigitalOcean regions should now appear as provisioning targets.

Common Connection Errors

"Unable to authenticate you" or "401 Unauthorized"
The token was copied incorrectly (truncated, extra spaces, or the token has already been deleted). Go back to the DigitalOcean API page, delete the old token, and generate a new one.
"Token does not have write access" or pre-flight permission error
The token was created with Read-only scope. Return to DigitalOcean API settings, delete the token, and generate a new one with Full Access (or at minimum, write scopes for Droplet, Volume, Firewall, SSH Key).
"Token expired"
The token's expiry date has passed. Generate a new token and update it in CloudAIPilot using the rotation procedure above.
Connection saved but no regions appear when provisioning
This can occur if your DigitalOcean account does not have billing active. Log in to the DigitalOcean control panel and confirm a payment method is attached and billing is enabled.

Human-in-the-Loop Safety

Once connected, CloudAIPilot reads your DigitalOcean account and can propose infrastructure changes. It will never create a Droplet, resize a volume, or delete any resource without generating an Approval Card for you to review and confirm first.

Revoking Access

To disconnect CloudAIPilot from your DigitalOcean account:

  • In CloudAIPilot: Cloud Accounts → [your account] → Remove
  • In DigitalOcean (immediate revocation): Go to API → Tokens, find the CloudAIPilot token, and click Delete. This immediately revokes all access regardless of the state in CloudAIPilot.

Related Articles