Skip to main content

Credentials

Create a DigitalOcean API token

Create and supply the DigitalOcean credential used by generated OpenTofu projects.

OPSd-generated DigitalOcean projects use an API token when OpenTofu creates or updates provider resources.

Create the token

  1. Sign in to DigitalOcean and open the API token settings.
  2. Create a personal access token for the environment you are provisioning.
  3. Grant the permissions needed by the resources in your selected blueprint. A project that creates infrastructure needs write access for those resource types. Use a separate token for each environment and revoke it when it is no longer needed.
  4. Copy the token when DigitalOcean displays it. Treat it as a password; the value may not be shown again.

DigitalOcean may change the available permission scopes. Check the current choices in the token settings and compare them with the resources listed in the generated project’s README before provisioning.

Supply the token

From the generated project directory, expose the token as an environment variable before running OpenTofu:

export TF_VAR_digitalocean_token="<your-token>"
tofu plan -var-file=tofu.tfvars

Do not commit the token, put it in the manifest, or save it in a tracked .tfvars file. Use your team’s secret manager for shared or production environments.