Skip to content
DNSmigrator
betaDNS betaCloud platformSetup guide checked 2026-09-27

DigitalOcean DNS

DigitalOcean access token setup: create a personal access token with only the domain scopes needed to preview or apply your migration.

On this page

DigitalOcean access token permissions

Credential type
Personal access token
Preview access
`domain:read`
Apply access
`domain:read`, `domain:create`, `domain:update` and `domain:delete`
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

Token scopes cannot be edited after creation. Create a new token if you need to change between preview-only and apply access.

DNSControl id

creds.json TYPE
{
  "TYPE": "DIGITALOCEAN"
}

Create credentials

Create a personal access token with only the domain scopes needed to preview or apply your migration.

Access you'll grant

Preview

domain:read

Apply

domain:read, domain:create, domain:update and domain:delete

Token scopes cannot be edited after creation. Create a new token if you need to change between preview-only and apply access.

Before you start

  • A DigitalOcean team account that can access the domains. DigitalOcean DNS management is free.
  • Permission to create personal access tokens for your account.

Setup steps

0 of 5 done

  1. Open Personal access tokens

    Sign in and go to Account → API. Under Applications & API, open Tokens → Personal access tokens.

    Open DigitalOcean API tokens

  2. Start a new token

    Select Generate New Token, enter a recognizable Token name, and choose an Expiration that covers the migration.

  3. Grant the domain scopes

    Under Scopes, select Custom Scopes. For a source or preview-only connection, grant read. For a destination connection, grant all four domain scopes.

    Previewdomain:read
    Applydomain:read, domain:create, domain:update, domain:delete

  4. Generate and copy the token

    Select Generate Token and copy the secret immediately. DigitalOcean displays it only once.

  5. Paste the token

    Paste the complete secret into Personal access token here. Do not add Bearer or surrounding quotes.

Troubleshooting

DigitalOcean rejects the token

The token may be incomplete, expired or revoked. Generate a replacement and copy the whole one-time secret.

The domain list is empty

Confirm that the token belongs to the DigitalOcean team that owns the domains and includes domain:read.

Preview works but apply returns 403

A read-only token cannot write. Create a new token with domain:create, domain:update and domain:delete in addition to domain:read.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
Personal access tokentokenRequiredThe secret shown once after you select Generate Token; paste it without a Bearer prefix.

Capabilities

Create zones
Yes
List zones
Yes
DNSSEC
Not available through this connection
Minimum TTL
30 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA

Caveats

  • DigitalOcean nameservers don't support DNSSEC, so turn DNSSEC off at the registrar before switching to them.
  • TXT records are limited to roughly 500 characters in total and can't contain backslashes.
  • CAA records can't use a bare ";" value or CA parameters such as "letsencrypt.org; accounturi=…".

Troubleshooting

DigitalOcean rejects the token
The token may be incomplete, expired or revoked. Generate a replacement and copy the whole one-time secret.
The domain list is empty
Confirm that the token belongs to the DigitalOcean team that owns the domains and includes domain:read.
Preview works but apply returns 403
A read-only token cannot write. Create a new token with domain:create, domain:update and domain:delete in addition to domain:read.

Related links

DigitalOcean DNS migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → DigitalOceanRoute 53 → DigitalOceanAzure DNS → DigitalOceanCloud DNS → DigitalOcean