# DigitalOcean > Connect a read-only DigitalOcean personal access token to LevelFour. Source: https://docs.levelfour.ai/connectors/digitalocean ## Prerequisites * A DigitalOcean team. Connect one team per token. * A team role that can see billing and resources, such as Owner. A token only carries the reads its creator's role allows. ## Connect ### Generate a token in DigitalOcean Sign in to the DigitalOcean control panel and switch to the team you want to connect. Open **API**, then **Tokens**, and click **Generate New Token**. Name it for LevelFour and choose an expiration. Under **Scopes**, choose **Read Only**. LevelFour can then read your billing and resources, including resource types DigitalOcean adds later, and cannot create, change, or delete anything. Read Only does not include database credentials or Kubernetes cluster credentials. For spend alone, **read** on `account` and `billing` is enough. Your costs, invoices and tags all arrive on that pair. The resource scopes below are what add the estate: which Droplets, volumes and snapshots you are paying for. `monitoring` adds how hard each one works, which is what turns an unused Droplet into a saving. Click **Generate Token** and copy it. It starts with `dop_v1_`, and DigitalOcean shows it only once. > **Note** > > If your security policy requires the narrowest token, choose **Custom Scopes** instead and tick **read** on `account`, `billing`, `droplet`, `block_storage`, `snapshot`, `database`, `kubernetes`, `load_balancer`, `reserved_ip`, `app`, `project`, `sizes`, and `monitoring`. Leave `monitoring` out and LevelFour can still read your bill, but it can never tell you a Droplet is idle. DigitalOcean does not let you add scopes to a custom token later, so a new resource type means a new token. > **Warning** > > Do not choose **Full Access**. It lets the token create, change, and delete resources. ### Add it to LevelFour Open **Connect Providers**, select **DigitalOcean**, and click **Add access token**. Paste the token, then click **Connect account**. ## Confirming it worked The connection moves to **Connected**. Your first data appears within a day. If the connection shows **Warning** with a note about missing scopes, the token could not list some resource types, or could not read utilization. LevelFour keeps syncing costs either way. See [Rotating the credential](#rotating-the-credential) to replace the token. ## Measuring utilization Telling you a Droplet is idle, or a size too big, needs more than the bill. LevelFour reads DigitalOcean's own monitoring for that, and two things have to be true before it can. **The token needs the `monitoring` scope.** Read Only includes it. A custom token that omits it leaves the connection in **Warning**. **The Droplet needs the DigitalOcean metrics agent.** Without the agent a Droplet reports its bandwidth and nothing else: no CPU, no memory, no disk, no load average. LevelFour will not call a Droplet idle on bandwidth alone, so it stays quiet about that Droplet rather than guessing at it. DigitalOcean installs the agent when you create a Droplet with monitoring enabled, and every Kubernetes worker node has it. To add it to a Droplet that is already running, run this on the Droplet: ```bash title="Install the DigitalOcean metrics agent" curl -sSL https://repos.insights.digitalocean.com/install.sh | sudo bash ``` [DigitalOcean's install guide](https://docs.digitalocean.com/products/monitoring/how-to/install-agent/) covers other install methods and how to confirm the agent is reporting. > **Note** > > A fortnight of readings has to accumulate before the first idle or right-size finding appears. A Droplet watched for two days is not evidence, so LevelFour waits rather than acting on a quiet weekend. > **Note** > > LevelFour never recommends deleting or resizing a Kubernetes worker node. The cluster owns those, and replaces any node you remove. ## Rotating or removing access ### Rotating the credential Generate a new Read Only token, paste it into **Connect Providers**, then delete the old token in DigitalOcean. Rotating does not repeat the first import. ### Removing access Disconnect DigitalOcean under **Connect Providers**, then delete the token under **API** in the DigitalOcean control panel. ## Troubleshooting | Symptom | What to do | | ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | The token is refused | Check that it is Read Only (or has `account:read` and `billing:read`), that it has not expired, and that its creator can see billing. The token stops working if the person who created it leaves the team | | The connection shows **Warning** about missing scopes | A custom token lacks a resource scope. Generate a Read Only token and rotate it | | The connection shows **Warning** about utilization | The token cannot read `monitoring`. Generate a Read Only token and rotate it | | No Droplet is ever reported idle or oversized | Those Droplets have no metrics agent, the token lacks `monitoring`, or the first fortnight of readings is still building. See [Measuring utilization](#measuring-utilization) | | Databases are not listed | The token can read database credentials. Generate a Read Only token, or a custom token without `database:view_credentials` | | A daily figure differs from the invoice | Daily figures are DigitalOcean's nightly estimates. The reconciliation line added when the invoice arrives makes the month match the invoice | | Spend from another team is missing | Each team needs its own token and connection. LevelFour does not read organization-level billing across several teams yet | ## Next * [Connect Providers](/connectors) lists every provider you can connect