DigitalOcean

Connect DigitalOcean so agents can inventory Droplets, apps, databases, and Kubernetes, review network exposure, and read billing.

Connect DigitalOcean so CloudThinker can inventory your Droplets, App Platform apps, managed databases, Kubernetes clusters, and volumes, review firewalls and load balancers for exposure, and answer questions about your balance and invoices. The connection uses a DigitalOcean personal access token and is read-only, except that it can create or delete an empty VPC after you confirm. That’s the only write, kept because an empty VPC costs nothing and can be removed. Most teams can leave it out.

---

Prerequisites

• A DigitalOcean account on the team that owns the resources you want to investigate.
• Permission to generate personal access tokens for that team.
• A CloudThinker workspace where you can add connections.

---

Setup

1. Generate a personal access token

   Tokens belong to the team that’s selected when you create them. In the DigitalOcean Control Panel, switch to the team that owns the resources in the team switcher (top left) first.

   Then open the Tokens page and click Generate New Token. Fill in:

   Field	Value
   Token name	cloudthinker
   Expiration	A fixed lifetime, such as 90 days
   Scopes	Read Only, or Custom Scopes with the list in Required permissions

   Copy the token right away. DigitalOcean shows it only once.

2. Add the connection in CloudThinker

   In the sidebar, click More → Workspace settings → Connections. On the Builtin Connections tab, search for DigitalOcean, paste the token into API token, and click Connect. CloudThinker reads your account to check the token.

   Success state: the DigitalOcean card shows a Connected status.

3. Run the verify prompt

   Run the verify prompt in a new chat.

   Success state: CloudThinker returns your account status and resource limits, such as how many Droplets the account can create.

---

Connection details

Field	Environment key	What to enter
API token	DIGITALOCEAN_API_TOKEN	A personal access token with read access to the resources CloudThinker should inspect

---

Required permissions

Read Only is the simplest choice. It covers every read this connection makes. To narrow access, pick Custom Scopes and choose from this table.

Scope	What it unlocks
account:read	Account status and limits. Required: CloudThinker reads the account to check the token.
billing:read	Balance, billing history, and invoices
droplet:read	Droplet inventory and detail
app:read	App Platform apps and deployment status
database:read	Managed database clusters
kubernetes:read	Kubernetes clusters and node pools
vpc:read, firewall:read, load_balancer:read	Networking inventory and exposure review
regions:read	Region availability
monitoring:read, uptime:read	Alert policies and uptime checks
block_storage:read	Block volumes
vpc:create, vpc:delete	Optional. Lets CloudThinker create and delete empty VPCs.

Leave out vpc:create and vpc:delete and the token can’t write anything. DigitalOcean doesn’t let you edit scopes later, so changing access means generating a new token and updating the connection.

---

Agent capabilities

Capability	What CloudThinker reads or does
Account and billing	Account status and limits, current balance, billing history, invoice summaries
Droplets	Droplet inventory and single-Droplet detail
App Platform	Apps, app detail, and active deployment status
Databases	Managed clusters with engine, version, region, size, nodes, and status
Kubernetes	Clusters, cluster detail, and node pools
Networking	VPCs, firewalls, load balancers, and region availability
Monitoring	Alert policies, uptime checks, and uptime check state
Storage	Block volumes
VPC lifecycle	Creates or deletes an empty VPC. Each one goes through your Approvals before it runs. With a Read Only token, DigitalOcean refuses the request with a permission error.

What this connection doesn’t do: it never returns Kubernetes credentials (kubeconfig) or database connection strings, and it doesn’t cover Spaces, Functions, DNS records, or Container Registry. To work inside a cluster, add a Kubernetes connection.

Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself.

To be asked every time, choose Manual as your Approval mode so a person approves every change. Once CloudThinker turns on Rule enforcement for your workspace, an Ask first Rule can narrow that to this connection alone.

Lists are read one page at a time. When CloudThinker says “20 Droplets”, it means 20 were read and tells you if more exist. Ask for the full list when you need a complete count.

Verify the connection

Check the DigitalOcean connection and summarize my account status and limits

Example prompts

List my DigitalOcean Droplets, apps, and databases as a table with region and status
Review my DigitalOcean firewalls and load balancers and flag anything open to the internet
Show my DigitalOcean balance and last three invoices

---

Troubleshooting

DigitalOcean API token is invalid or expired

DigitalOcean rejected the token. Generate a new one on the Tokens page. Then open the connection, click the edit icon on the instance, click Replace… in Edit Instance, paste the token, and click Save and test.

DigitalOcean API token needs account:read permission

The token works but lacks the scope CloudThinker uses to check it. Generate a new token that includes account:read, then update the connection.

Expected resources are missing

The token’s scopes don’t cover that resource type, or the resources belong to another team. Generate the token from the owning team with the scopes you need.

DigitalOcean API rate limit reached

DigitalOcean is throttling requests. Wait and retry, and ask about one resource type at a time so each run makes fewer calls.

Account verification timed out or is temporarily unavailable

DigitalOcean didn’t answer in time. Retry Connect. If it keeps failing, check DigitalOcean’s status page before generating a new token.

A VPC change never ran

Each VPC create or delete goes through your Approvals on its own, and approving a create doesn’t cover a delete. If one is waiting on you, answer the request in chat. A “no” is final for that request.

---

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• The token is the boundary: CloudThinker can’t do more than the token’s scopes allow, so a read-only token makes writes impossible at DigitalOcean.
• Set an expiration: DigitalOcean tokens don’t rotate on their own. Pick a lifetime when you create the token and rotate on that schedule.

---

Related

Kubernetes connection

Connect a DOKS cluster directly for workload-level investigation

Connections overview

See every platform you can connect and how connections work