DigitalOcean API Credentials

Store a DigitalOcean personal access token in Ankra - a Read & Write token used to provision droplet clusters and DigitalOcean Kubernetes (DOKS).

DigitalOcean API credentials store a DigitalOcean personal access token, used to provision and manage self-managed DigitalOcean droplet clusters and DigitalOcean Kubernetes (DOKS). The token is validated when you save it - Ankra makes a read-only call to the DigitalOcean API (GET /v2/account), so a rejected or mistyped token is refused immediately.

What Ankra Accesses

One token covers both cluster types. For self-managed droplet clusters, Ankra provisions the infrastructure directly:

Resource	Operations	Why it’s used
Droplets	create, read, power actions, delete	The cluster’s nodes and bastion
SSH keys	upload, read, delete	Install your SSH key credential on the droplets it creates
VPCs	create, read, update, delete	The cluster’s private network
Firewalls	create, read, delete	Restrict access to the cluster’s droplets
VPC NAT gateways	create, read, delete	Outbound internet access for private nodes
Tags	create, delete	Group the cluster’s resources for cleanup
Load balancers	read, delete	Created by Kubernetes itself (the DigitalOcean cloud controller) - Ankra only cleans them up when you delete the cluster
Regions and sizes	read	Placement options and list prices in the cluster wizard

For DOKS, Ankra uses the managed Kubernetes API instead:

Resource	Operations	Why it’s used
Kubernetes clusters	create, read, delete	DOKS cluster lifecycle
Node pools	create, read, update, delete	Scale and manage the cluster’s node pools
Kubeconfig	read	Connect Ankra’s agent to the cluster
Kubernetes options	read	Available versions, regions, and node sizes in the wizard

Creating a DigitalOcean API Credential

1. Get a DigitalOcean token

   1. Log in to the DigitalOcean Control Panel
   2. Go to API → Tokens → Generate New Token
   3. Give it Read & Write access - with Full Access scopes, or custom scopes covering at least droplet, ssh_key, vpc, firewall, tag, load_balancer, and kubernetes (add regions and sizes read for the wizard’s options)
   4. Copy the token (prefixed with dop_v1_; shown once)
2. Add to Ankra (UI)

   Go to Credentials → Add → DigitalOcean, then provide:

   • Name: a unique identifier - lowercase letters and numbers only, cannot start with a hyphen (e.g. do-prod)
   • API Token: the token from the previous step

   Click Test connection to verify the token against the DigitalOcean API, then save.

3. Or via CLI

   ankra credentials digitalocean create --name my-do-token
   # You will be securely prompted for the API token
   

For self-managed droplet clusters you also need an SSH key credential - create one with ankra credentials digitalocean ssh-key create --name my-key --generate.

The token can be rotated later from the credential’s page without recreating the credential - everything using it picks up the new token automatically.

Listing DigitalOcean Credentials

CLI

ankra credentials digitalocean list

Troubleshooting DigitalOcean Credentials

The table below covers the Test connection result in the Ankra UI:

Test connection result	Cause	Solution
DigitalOcean rejected the API token.	The token is invalid, revoked, expired, or was copied incompletely	Generate a new token and paste the full dop_v1_... value
Could not reach the DigitalOcean API.	Network or connectivity issue	Retry; ensure outbound access to api.digitalocean.com
DigitalOcean returned HTTP <code>.	Unexpected DigitalOcean-side response	Retry; check the DigitalOcean status page if it persists

Test connection verifies the token is accepted, not that it has every scope. If the credential saves fine but provisioning later fails with a permissions error, the token is read-only or missing a scope from the lists above - generate a token with the right scopes and rotate it in on the credential’s page.