How to connect a DigitalOcean team to AuditBadger with a custom-scoped, read-only personal access token. Takes about 5 minutes.

---

## **1. Create the personal access token**

1. In the DigitalOcean control panel, open **API → Tokens**.

2. Click **Generate New Token** and name it `AuditBadger Compliance Read-Only`.

3. Pick the longest expiration your policy allows (or no expiration if available) and note the date — you will enter it in AuditBadger.

4. Under scopes, choose **Custom Scopes** — do not use the Read Only or Full Access presets.

5. In the scope picker, search for each entry below and tick **only its read checkbox**. Leave every create, update, delete, and admin checkbox unticked:

   * `account:read`

   * `project:read`

   * `regions:read`

   * `tag:read`

   * `droplet:read`

   * `image:read`

   * `snapshot:read`

   * `block_storage:read`

   * `block_storage_snapshot:read`

   * `firewall:read`

   * `vpc:read`

   * `vpc_peering:read`

   * `reserved_ip:read`

   * `load_balancer:read`

   * `certificate:read`

   * `domain:read`

   * `ssh_key:read`

   * `uptime:read`

   * `actions:read`

   * `database:read`

   * `kubernetes:read`

   * `cdn:read`

6. Click **Generate Token**.

7. Copy the token immediately — DigitalOcean shows it only once.

Tick nothing else. In particular never grant `api:read`, `api:write`, any write scope, `database:view_credentials`, `kubernetes:access_cluster`, `app:access_console`, `security:read`, or Spaces key scopes. AuditBadger does not need them, and its API client is hard-limited to an allowlist of GET endpoints, so it will refuse to use them.

## **2. Connect in AuditBadger**

1. Go to **Account Settings → Integrations → DigitalOcean** (the tab appears when the feature flag is enabled for your account).

2. Paste the token and, if it expires, enter the expiration date so AuditBadger can remind you before collection stops.

3. Save. AuditBadger validates the connection in the background and discovers the team identity via `GET /v2/account`.

4. Once connected, install evidence sources on your compliance controls (individually from a control, or in bulk via "Install evidence sources").

## **Token rotation**

1. Generate a new custom-scoped token in DigitalOcean with the same scopes.

2. On the integration page, open **Configuration**, paste the new token, update the expiration date, and save. Evidence sources and collected evidence are kept.

3. After AuditBadger re-validates, delete the old token in DigitalOcean.

## **Troubleshooting**

* **"Permission denied — the token is missing a required scope"** - the token was created without one of the scopes above. Generate a new token with the full checklist; scopes cannot be edited after creation.

* **"Invalid or expired personal access token"** - the token was revoked or expired. Generate and paste a new one.

* **Token expiring soon warning** - generate a new token and update the configuration before the expiry date; collection stops when the token expires.

* **A domain/uptime source collects nothing** - the team hosts no DNS zones or uptime checks on DigitalOcean; those sources only produce evidence for resources that exist.