# Create a DigitalOcean API token

> You only need this if you'd rather not use Connect with DigitalOcean, which does the same job without a token. If you do want one, it takes about a minute.

Source: https://infranest.io/docs/create-a-digitalocean-api-token
Last updated: 2026-08-30

---

A short guide for anyone who'd rather connect DigitalOcean with a manually-created API token instead of the one-click option. It's for InfraNest users managing DNS through DigitalOcean.

## Overview

- You only need this if you'd rather not use **Connect with DigitalOcean**, which does the same job without a token.
- If you do want a token, it takes about a minute to create.
- You'll paste the token into InfraNest to finish connecting the account.

## Create the token

1. Sign in to **DigitalOcean**.
2. Open the tokens page — the **Open token page** link on the InfraNest connect screen takes you straight there, or use the left-hand menu: **API** (right at the bottom), then the **Tokens** tab.
3. Select **Generate New Token**.
4. Give it a name you'll recognise, such as *InfraNest*.
5. Choose an **expiry**. See the note below before you pick one.
6. Choose the scopes — **Full Access** is fine, or see the list below for a narrower token.
7. Select **Generate Token**, then copy the value. It starts with `dop_v1_`.
8. Paste it into InfraNest — see **Connect DigitalOcean**.

> [!WARNING]
> The token is shown once. If you navigate away without copying it, generate a new one rather than trying to find it again.

## Which scopes it needs

**Full Access** works and is the quickest choice. If you'd rather give it only what InfraNest uses, pick **Custom Scopes** and tick:

- **domain** — *read*, *create*, *update* and *delete*. This is DNS: reading your zones and records, and saving changes you make in InfraNest.
- **certificate** — *read*. This is the certificate list. Read only; InfraNest never changes a certificate at DigitalOcean.

Nothing else is needed. A token without the **domain** update and delete scopes will show your records perfectly and then refuse every edit, which is a confusing way to find out.

> [!NOTE]
> Unlike some providers, DigitalOcean can't pre-tick these for you from a link — the connect screen lists them beside the button so you can copy the selection across.

## About the expiry

DigitalOcean asks you to pick how long the token lasts, and the default is not "forever". When it expires, your zones stop syncing and InfraNest emails you that the integration has a problem — it isn't broken, it just needs a new token.

Either choose **No expiry**, or put the date in your calendar so you can replace it before it lapses.

## Replace a token

1. Generate the new token first (follow the steps above).
2. Open **Integrations** → **DigitalOcean**.
3. Select **Reconnect** to paste in the new token.
4. Delete the old token at DigitalOcean afterwards.

Nothing you've set up in InfraNest is affected — the connection keeps its zones, its history and its settings.