Connect DigitalOcean to Conduit

This walkthrough connects DigitalOcean (Cloud Infrastructure) to Conduit. DigitalOcean appears in the catalog as a family of nine vendors, each scoped to one product area:

Catalog entry	Slug
DigitalOcean Apps	digitalocean-apps
DigitalOcean Databases	digitalocean-databases
DigitalOcean Docs	digitalocean-docs
DigitalOcean Kubernetes (DOKS)	digitalocean-doks
DigitalOcean Droplets	digitalocean-droplets
DigitalOcean Functions	digitalocean-functions
DigitalOcean Inference Model Catalog	digitalocean-inference
DigitalOcean Networking	digitalocean-networking
DigitalOcean Spaces	digitalocean-spaces

Each entry is a separate connectable vendor backed by a DigitalOcean-hosted MCP endpoint for that product area — connecting Droplets does not connect Databases. But they all authenticate the same way: one account-level DigitalOcean personal access token works across the whole family. You create the token once, then paste it into each product area you want your AI clients to use.

Menu labels can change

The DigitalOcean-portal steps below stay deliberately generic; the control panel changes between releases. Follow DigitalOcean’s token guide as the authority for creating a personal access token.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A DigitalOcean account (or team membership) that can create API tokens. The token acts with the access of the account that creates it, across the resources that account can reach.

Step 1 — Create a DigitalOcean personal access token

1. Sign in to the DigitalOcean control panel and open the API tokens area.
2. Generate a new personal access token, following DigitalOcean’s guide.
3. When choosing the token’s scopes, include both read and write access if you want the AI to be able to make changes (create Droplets, resize databases, and so on). A read-only token limits every product area to read-only tools — see Troubleshooting.
4. Copy the token immediately. DigitalOcean shows the full token value only once, at creation.

Caution

Copy the token now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the token, revoke it in DigitalOcean and generate a new one; the exposed token becomes useless immediately.

Step 2 — Connect DigitalOcean vendors in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find the DigitalOcean entry for the product area you want — for example DigitalOcean Droplets under Cloud Infrastructure — and click Connect. Expected: a credential form with a single Personal Access Token field.
3. Paste the token from Step 1 and click Connect. Expected: Conduit validates the token immediately by performing a live handshake with DigitalOcean’s MCP endpoint for that product area, then shows a green Connected status. A bad token is rejected here, not on the first tool call.
4. Repeat for each product area you want to enable, pasting the same token each time. Each entry is its own connection with its own Connected status, and disconnecting one does not affect the others.

The credential is stored at the organization scope, so every technician in your org shares the connection. (For per-technician tokens, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only DigitalOcean tool, such as listing Droplets (with digitalocean-droplets connected) or searching the docs (with digitalocean-docs connected). You should get real data back, and the call appears in your audit log with the correct user, the product-area vendor slug (for example digitalocean-droplets), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails immediately with “Invalid DigitalOcean Personal Access Token, or token lacks required DigitalOcean Droplets scope.” (the product-area name varies by entry)	The token was mistyped or copied incompletely, was revoked or has expired in DigitalOcean, or wasn’t granted the scopes that product area needs. Generate a fresh token with read + write scopes and re-connect.
Connect fails with “DigitalOcean … MCP returned HTTP NNN.”	A non-authentication error from DigitalOcean’s MCP endpoint — usually transient on DigitalOcean’s side. Retry; if it persists, check DigitalOcean’s status page.
Read tools work, but create/update/delete tools fail	The token was created read-only. DigitalOcean token scopes are fixed at creation — create a new token that includes write access, then update the credential on each connected DigitalOcean entry.
Every DigitalOcean entry stops working at the same time	The shared token expired (if you set an expiration at creation) or was revoked. Because one token backs the whole family, rotation means updating the credential on each connected digitalocean-* entry at /org/catalog.
Droplets works, but Databases tools don’t appear in your AI client	Each product area is a separate vendor connection. Connect DigitalOcean Databases itself — connecting one family member never enables the others.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Connecting an AI client — point Claude Desktop, Claude Code, Cursor, or any MCP client at Conduit.