# Connect DigitalOcean > Connect DigitalOcean to manage your Droplets and DNS from InfraNest, and to pull the SSL certificates on your account into your certificate list. Source: https://infranest.io/docs/connect-digitalocean Last updated: 2026-09-18 --- Connect your DigitalOcean account to manage Droplets and DNS right from InfraNest, and to keep an eye on your SSL certificates' expiry dates. This is for anyone hosting servers or domains with DigitalOcean. ## Overview - Manage your Droplets, DNS zones and records, volumes, VPCs, firewalls and load balancers without leaving InfraNest. - Pull the SSL certificates on your DigitalOcean account into your certificate list so they're covered by expiry reminders. - Your servers, zones and records appear automatically as soon as the connection is made. - DigitalOcean will host DNS for any domain, no matter who you bought the name from — you don't need to move the registration. > [!NOTE] > DigitalOcean doesn't sell domains. It only hosts DNS for names registered elsewhere, so renewals, transfer locks and WHOIS privacy stay with whoever you bought the name from. ## Before you start If you use **Connect with DigitalOcean**, you don't need anything ready in advance — you'll sign in at DigitalOcean and approve the connection there. If you'd rather use a token, you'll need a **DigitalOcean API token**. See **Create a DigitalOcean API token** for the steps and which permissions to give it. ## Connect DigitalOcean 1. Go to **Integrations** and open **DigitalOcean**. 2. Give the connection an **Account label** (optional — useful if you connect more than one account). 3. Choose which features to use it for: **Servers**, **DNS** and **Certificates**. 4. Either select **Connect with DigitalOcean** and approve it in the window that opens, or paste your **API token**. 5. Leave **Email me when this integration has problems** ticked if you'd like email warnings. 6. Select **Connect**. ![Connect DigitalOcean](/media/1206f122-71de-4d75-8546-1d1b42a2380b) ## What you get once it's connected - **Servers** — create Droplets from here, and your existing ones appear with their size, region, addresses and tags. Power them on and off, reboot, rebuild, take snapshots, turn DigitalOcean's weekly backups on or off, and see CPU, bandwidth and disk graphs you can build alerts on. - **Volumes, VPCs, firewalls and load balancers** — created, changed and deleted from here, not just listed. Attach a volume to a Droplet, edit a firewall's rules and apply it across several Droplets at once, and give a load balancer its services and targets. - **DNS** — see and edit your zones and records, and create or delete zones from here. Point your domain's nameservers at `ns1.digitalocean.com`, `ns2.digitalocean.com` and `ns3.digitalocean.com` and DigitalOcean answers for it. - **SSL certificates** — the certificates on your DigitalOcean account appear in your certificate list, with their names and expiry dates, so they're covered by your expiry reminders. ## Tips - **CPU graphs need DigitalOcean's monitoring agent** on the Droplet. Bandwidth always works because DigitalOcean measures it outside the machine, but CPU, memory and load come from an agent that's only installed if monitoring was switched on when the Droplet was made. Droplets created from InfraNest have it on automatically; for an older one, turn on monitoring in the DigitalOcean panel and the graph will start filling. - **Disk speed is graphed, but not disk operations.** DigitalOcean reports megabytes per second read and written, so that graph works and can be alerted on. It doesn't report operations per second (IOPS), so that alert isn't offered. ## Good to know - **Some things stay in the DigitalOcean panel**: the console, recovery mode and mounting an ISO have no API. Backups run on DigitalOcean's own weekly schedule and can't be started on demand — take a snapshot when you want one now. - **Rules built around tags are shown but not editable.** DigitalOcean can point a rule at Droplets, tags or load balancers as well as at plain addresses, and InfraNest only understands addresses. Those rules appear in the firewall marked **Managed at the provider** and are kept exactly as they are when you save — the rest of the firewall is yours to edit as normal. To change one, use DigitalOcean's own control panel. - **A VPC's address range is fixed** once it's created, and a Droplet can't be moved to a different VPC afterwards. Renaming one works here. - **Volume names and sizes can't be changed from here** for any provider yet — attach, detach and delete are what a volume offers today. - **Certificate files can't be downloaded.** DigitalOcean never hands the certificate itself back over its API, only the details, so InfraNest can show you what a certificate covers and when it expires but has nothing to give you to download. - **The shortest TTL is 30 seconds.** DigitalOcean refuses anything lower. - **The SOA record is read-only**, which is normal — DigitalOcean maintains it for you. ## Troubleshooting - **"Authentication failed"** — the token was deleted, or it expired. DigitalOcean tokens can be created with an expiry date; make a new one and paste it in under **Reconnect**. - **"DigitalOcean could not be reached" when connecting** — that message means exactly what it says: the connection wasn't refused, DigitalOcean simply didn't answer while we were checking it. Nothing is wrong with your account or your approval. Wait a minute and select **Connect** again. - **Some things work and one thing is refused** — your token has custom scopes and is missing one. The simplest fix is a Full Access token; otherwise see **Create a DigitalOcean API token** for the exact list. - **You connected with the button and a certificate won't import** — the approval you gave covers only the features that were ticked at the time. Disconnect, tick **Certificates** as well, and connect again. The same applies to **Servers**: a connection made for DNS alone was never given access to your Droplets. - **A Droplet's CPU graph is empty while bandwidth works** — that Droplet has no monitoring agent. See "Good to know" above; it isn't a problem with the connection.