Product updates

Updated API Management Tokens

Andrew Starr-Bochicchio

Posted: April 18, 20222 min read

Today, we are excited to highlight our new API access tokens to boost token management to help improve security and automation. If you’ve recently generated an API access token you’ve likely noticed a few convenient updates.

We recommend you revoke any old tokens and re-generate your existing tokens at your earliest convenience to receive the following benefits.

Secret scanning GitHub partnership

We are excited to announce that we partnered with GitHub to take part in their secret scanning program. GitHub regularly scans code repositories they host to identify API tokens and other secrets accidentally committed to public repositories.

Now, when using the new DigitalOcean API tokens, GitHub is able to notify us so we can take action to protect your account. When an API token has been publicly exposed, we will automatically revoke it and notify you to help you mitigate the impact of the leak.

Distinct tokens improve readability and automation

The new token format has prefixes to easily identify them from other tokens. You can parse your tokens reading or programmatically if you prefer.

Many use API tokens to trigger DevOps flows or desired events and the new prefixes make automation easier. You can now scan for tokens having the expected prefix.

Tip: there are three patterns of prefixing depending on where a token was generated.

Find unused tokens with Last Used At

We want to enable you to make better-informed decisions about tokens you revoke. The control panel now displays when a token was last used to access the API. Quickly find and revoke unused tokens without fear of impacting a production service.

Set expiration date

Tracking your API tokens can be a pain, and stray tokens left on a server or developer’s machine can pose major security risks.

We now support setting an expiration date when generating personal access tokens in the control panel. Shorter-lived tokens help to ensure they can’t be used in attacks without manually revoking.

Only newly generated API access tokens will have the new improvements and other upcoming features.

We encourage you to revoke any old tokens no longer in use and re-generate your existing tokens at your earliest convenience.

Happy coding,

Andrew Starr-Bochicchio

Senior Software Engineer II

Share

Try DigitalOcean for free

Click below to sign up and get $200 of credit to try our products over 60 days!Sign up

Related Articles

Introducing Global Load Balancer: Scale your HTTP traffic globally
product-updates

Introducing Global Load Balancer: Scale your HTTP traffic globally

Sr. Product Manager II

July 9, 20243 min read

DigitalOcean and HIPAA: Enabling Healthcare Innovation on our Platform
trust-security

DigitalOcean and HIPAA: Enabling Healthcare Innovation on our Platform

Manager, Trust and Governance

July 1, 20242 min read

5th Generation Xeon Processors are now available at DigitalOcean
product-updates

5th Generation Xeon Processors are now available at DigitalOcean

June 24, 20243 min read