wave
rectangle square backgroundrectangle square backgroundrectangle square backgroundrectangle square backgroundrectangle square backgroundrectangle square backgroundProduct Updates

Updated API Tokens new management features: in partnership with GitHub –Secret Scanning, Prefixes, and more!

Posted: April 18, 20222 min read

Today, we are excited to highlight our new API access tokens to boost token management to help improve security and automation. If you’ve recently generated an API access token you’ve likely noticed a few convenient updates.

We recommend you revoke any old tokens and re-generate your existing tokens at your earliest convenience to receive the following benefits.

Secret scanning GitHub partnership

We are excited to announce that we partnered with GitHub to take part in their secret scanning program. GitHub regularly scans code repositories they host to identify API tokens and other secrets accidentally committed to public repositories. 

Now, when using the new DigitalOcean API tokens, GitHub is able to notify us so we can take action to protect your account. When an API token has been publicly exposed, we will automatically revoke it and notify you to help you mitigate the impact of the leak.

Distinct tokens improve readability and automation

The new token format has prefixes to easily identify them from other tokens. You can parse your tokens reading or programmatically if you prefer. 

Many use API tokens to trigger DevOps flows or desired events and the new prefixes make automation easier. You can now scan for tokens having the expected prefix.

Tip: there are three patterns of prefixing depending on where a token was generated.

Find unused tokens with Last Used At

We want to enable you to make better-informed decisions about tokens you revoke. The control panel now displays when a token was last used to access the API. Quickly find and revoke unused tokens without fear of impacting a production service.

Set expiration date

Tracking your API tokens can be a pain, and stray tokens left on a server or developer’s machine can pose major security risks.

We now support setting an expiration date when generating personal access tokens in the control panel. Shorter-lived tokens help to ensure they can’t be used in attacks without manually revoking. 

Only newly generated API access tokens will have the new improvements and other upcoming features.

We encourage you to revoke any old tokens no longer in use and re-generate your existing tokens at your earliest convenience.

Happy coding,

Andrew Starr-Bochicchio

Senior Software Engineer II

Share

TwitterFacebookLinkedInHackerNews

Optimize your streaming business

Download our guide to learn how streaming businesses can optimize their architecture to save costs.

Download now

Related Articles

Latest products and features at DigitalOcean: August 2022 
product-updates

Latest products and features at DigitalOcean: August 2022 

September 9, 20223 min read

Announcing DigitalOcean Uptime: Real-time uptime and latency alerts
product-updates

Announcing DigitalOcean Uptime: Real-time uptime and latency alerts

September 8, 20223 min read

Introducing DigitalOcean Support Plans
product-updates

Introducing DigitalOcean Support Plans

June 21, 20223 min read

Sea floor left
Sea floor middle
Sea floor right