closedloop.email
Blog How it works Contact Sign in Get a loop

How to create a DigitalOcean API token

2026-07-22

DigitalOcean supports custom-scoped tokens, so you can grant closedloop exactly the permissions it needs without giving full account access. Here is how.

What you need

A DigitalOcean account. If you do not have one, sign up at digitalocean.com. New accounts get $200 in free credit for 60 days.

Step by step

  1. Log in to the DigitalOcean Control Panel.

  2. Click API in the left sidebar (under your team name).

  3. On the Tokens tab, click Generate New Token.

  4. Enter a Token name — something like closedloop.

  5. Set an Expiration. You can choose no expiration, or set a date far in the future so the token does not expire unexpectedly.

  6. Under Scopes, select Custom Scopes. closedloop needs these specific permissions:

    • Droplets: Create, Read, Update, Delete (all four)
    • Firewalls: Create, Read, Update, Delete (all four)
    • SSH Keys: Read, Create
    • Regions: Read
    • Images: Read

    Alternatively, select Full Access if you prefer not to configure individual scopes.

  7. Click Generate Token. Copy the token immediately — it is shown only once.

What closedloop does with it

When you paste this token:

  1. We validate it and upload our admin SSH key to your account.
  2. We provision a Droplet with a firewall that blocks all inbound and outbound mail ports (25, 465, 587, 993).
  3. After you claim the loop, you can revoke our SSH key from the dashboard.
  4. The token is deleted once the loop is provisioned — we do not keep it. To destroy the loop later, you provide one again for that single action.

Custom scope gotchas

  • DigitalOcean introduced custom scopes in 2024. If your account predates that, the interface may look slightly different but the options are the same.
  • You cannot change scopes after creating a token. If you picked the wrong ones, create a new token and delete the old one.
  • The token must have Write access to Droplets, Firewalls, and SSH Keys. Read only tokens will be rejected.
  • closedloop does not use block storage — the mailbox data lives on the Droplet's own disk — so there is no need to grant the Volumes scope.

Create your loop →

More for you: