Provider Connectors
DigitalOcean
Connect a read-only DigitalOcean personal access token to LevelFour.
Prerequisites
- A DigitalOcean team. Connect one team per token.
- A team role that can see billing and resources, such as Owner. A token only carries the reads its creator's role allows.
Connect
Generate a token in DigitalOcean
Sign in to the DigitalOcean control panel and switch to the team you want to connect. Open API, then Tokens, and click Generate New Token. Name it for LevelFour and choose an expiration.
Under Scopes, choose Read Only. LevelFour can then read your billing and resources, including resource types DigitalOcean adds later, and cannot create, change, or delete anything. Read Only does not include database credentials or Kubernetes cluster credentials.
For spend alone, read on account and billing is enough. Your costs, invoices and tags all arrive on that pair. The resource scopes below are what add the estate: which Droplets, volumes and snapshots you are paying for. monitoring adds how hard each one works, which is what turns an unused Droplet into a saving.
Click Generate Token and copy it. It starts with dop_v1_, and DigitalOcean shows it only once.
account, billing, droplet, block_storage, snapshot, database, kubernetes, load_balancer, reserved_ip, app, project, sizes, and monitoring. Leave monitoring out and LevelFour can still read your bill, but it can never tell you a Droplet is idle. DigitalOcean does not let you add scopes to a custom token later, so a new resource type means a new token.Add it to LevelFour
Open Connect Providers, select DigitalOcean, and click Add access token. Paste the token, then click Connect account.
Confirming it worked
The connection moves to Connected. Your first data appears within a day.
If the connection shows Warning with a note about missing scopes, the token could not list some resource types, or could not read utilization. LevelFour keeps syncing costs either way. See Rotating the credential to replace the token.
Measuring utilization
Telling you a Droplet is idle, or a size too big, needs more than the bill. LevelFour reads DigitalOcean's own monitoring for that, and two things have to be true before it can.
The token needs the monitoring scope. Read Only includes it. A custom token that omits it leaves the connection in Warning.
The Droplet needs the DigitalOcean metrics agent. Without the agent a Droplet reports its bandwidth and nothing else: no CPU, no memory, no disk, no load average. LevelFour will not call a Droplet idle on bandwidth alone, so it stays quiet about that Droplet rather than guessing at it.
DigitalOcean installs the agent when you create a Droplet with monitoring enabled, and every Kubernetes worker node has it. To add it to a Droplet that is already running, run this on the Droplet:
curl -sSL https://repos.insights.digitalocean.com/install.sh | sudo bashDigitalOcean's install guide covers other install methods and how to confirm the agent is reporting.
Rotating or removing access
Rotating the credential
Generate a new Read Only token, paste it into Connect Providers, then delete the old token in DigitalOcean. Rotating does not repeat the first import.
Removing access
Disconnect DigitalOcean under Connect Providers, then delete the token under API in the DigitalOcean control panel.
Troubleshooting
| Symptom | What to do |
|---|---|
| The token is refused | Check that it is Read Only (or has account:read and billing:read), that it has not expired, and that its creator can see billing. The token stops working if the person who created it leaves the team |
| The connection shows Warning about missing scopes | A custom token lacks a resource scope. Generate a Read Only token and rotate it |
| The connection shows Warning about utilization | The token cannot read monitoring. Generate a Read Only token and rotate it |
| No Droplet is ever reported idle or oversized | Those Droplets have no metrics agent, the token lacks monitoring, or the first fortnight of readings is still building. See Measuring utilization |
| Databases are not listed | The token can read database credentials. Generate a Read Only token, or a custom token without database:view_credentials |
| A daily figure differs from the invoice | Daily figures are DigitalOcean's nightly estimates. The reconciliation line added when the invoice arrives makes the month match the invoice |
| Spend from another team is missing | Each team needs its own token and connection. LevelFour does not read organization-level billing across several teams yet |
Next
- Connect Providers lists every provider you can connect