> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# DigitalOcean API Credentials

> Store a DigitalOcean personal access token in Ankra - a Read & Write token used to provision droplet clusters and DigitalOcean Kubernetes (DOKS).

DigitalOcean API credentials store a DigitalOcean personal access token, used to provision and manage self-managed [DigitalOcean droplet clusters](/guides/digitalocean-clusters) and [DigitalOcean Kubernetes (DOKS)](/guides/doks-clusters). The token is validated when you save it - Ankra makes a read-only call to the DigitalOcean API (`GET /v2/account`), so a rejected or mistyped token is refused immediately.

## What Ankra Accesses

One token covers both cluster types. For self-managed droplet clusters, Ankra provisions the infrastructure directly:

| Resource          | Operations                          | Why it's used                                                                                                            |
| ----------------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| Droplets          | create, read, power actions, delete | The cluster's nodes and bastion                                                                                          |
| SSH keys          | upload, read, delete                | Install your [SSH key credential](/platform/credentials/ssh-key) on the droplets it creates                              |
| VPCs              | create, read, update, delete        | The cluster's private network                                                                                            |
| Firewalls         | create, read, delete                | Restrict access to the cluster's droplets                                                                                |
| VPC NAT gateways  | create, read, delete                | Outbound internet access for private nodes                                                                               |
| Tags              | create, delete                      | Group the cluster's resources for cleanup                                                                                |
| Load balancers    | read, delete                        | Created by Kubernetes itself (the DigitalOcean cloud controller) - Ankra only cleans them up when you delete the cluster |
| Regions and sizes | read                                | Placement options and list prices in the cluster wizard                                                                  |

For [DOKS](/guides/doks-clusters), Ankra uses the managed Kubernetes API instead:

| Resource            | Operations                   | Why it's used                                             |
| ------------------- | ---------------------------- | --------------------------------------------------------- |
| Kubernetes clusters | create, read, delete         | DOKS cluster lifecycle                                    |
| Node pools          | create, read, update, delete | Scale and manage the cluster's node pools                 |
| Kubeconfig          | read                         | Connect Ankra's agent to the cluster                      |
| Kubernetes options  | read                         | Available versions, regions, and node sizes in the wizard |

## Creating a DigitalOcean API Credential

<Steps>
  <Step title="Get a DigitalOcean token">
    1. Log in to the [DigitalOcean Control Panel](https://cloud.digitalocean.com/account/api/tokens)
    2. Go to **API** → **Tokens** → **Generate New Token**
    3. Give it **Read & Write** access - with **Full Access** scopes, or custom scopes covering at least `droplet`, `ssh_key`, `vpc`, `firewall`, `tag`, `load_balancer`, and `kubernetes` (add `regions` and `sizes` read for the wizard's options)
    4. Copy the token (prefixed with `dop_v1_`; shown once)
  </Step>

  <Step title="Add to Ankra (UI)">
    Go to **Credentials** → **Add** → **DigitalOcean**, then provide:

    * **Name**: a unique identifier - lowercase letters and numbers only, cannot start with a hyphen (e.g. `do-prod`)
    * **API Token**: the token from the previous step

    Click **Test connection** to verify the token against the DigitalOcean API, then save.
  </Step>

  <Step title="Or via CLI">
    ```bash theme={null}
    ankra credentials digitalocean create --name my-do-token
    # You will be securely prompted for the API token
    ```
  </Step>
</Steps>

For self-managed droplet clusters you also need an [SSH key credential](/platform/credentials/ssh-key) - create one with `ankra credentials digitalocean ssh-key create --name my-key --generate`.

<Note>
  The token can be rotated later from the credential's page without recreating the credential - everything using it picks up the new token automatically.
</Note>

## Listing DigitalOcean Credentials

<CodeGroup>
  ```bash CLI theme={null}
  ankra credentials digitalocean list
  ```

  ```bash cURL theme={null}
  curl https://platform.ankra.app/api/v1/credentials/digitalocean \
    -H "Authorization: Bearer $ANKRA_API_TOKEN"
  ```
</CodeGroup>

## Troubleshooting DigitalOcean Credentials

The table below covers the **Test connection** result in the Ankra UI:

| Test connection result                | Cause                                                              | Solution                                                                                    |
| ------------------------------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------- |
| DigitalOcean rejected the API token.  | The token is invalid, revoked, expired, or was copied incompletely | Generate a new token and paste the full `dop_v1_...` value                                  |
| Could not reach the DigitalOcean API. | Network or connectivity issue                                      | Retry; ensure outbound access to `api.digitalocean.com`                                     |
| DigitalOcean returned HTTP `<code>`.  | Unexpected DigitalOcean-side response                              | Retry; check the [DigitalOcean status page](https://status.digitalocean.com) if it persists |

**Test connection** verifies the token is accepted, not that it has every scope. If the credential saves fine but provisioning later fails with a permissions error, the token is read-only or missing a scope from the lists above - generate a token with the right scopes and rotate it in on the credential's page.