DigitalOcean API is telling me "oauth2: token expired and refresh token is not set", but I'm not using oauth2

Posted on April 23, 2024

I rely on personal access tokens which I use to solve DNS challenges for my web servers (I have some domains which point to a private IP for a VPN). My certificate (Let’s Encrypt) expired today, and my web server is unable to solve the DNS challenge because the DigitalOcean API is returning this error every time it attempts to access the API:

“Post "https://api.digitalocean.com/v2/domains/cw-server.cloud/records\”: oauth2: token expired and refresh token is not set (order=https://acme.zerossl.com/v2/DV90/order/zyTp3qewiKYI7N8Y9Wi01w) (ca=https://acme.zerossl.com/v2/DV90)"

I’ve tried re-generating my access token but it doesn’t work. My token is set to never expire (as was my original one), so I’m confused as to why the API thinks I need token refreshing for oauth2 when I don’t even use oauth on the DigitalOcean platform.

Please let me know if I need to provide more info

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Bobby

April 23, 2024

Hi there,

Can you share the exact API request that you are making?

When using an access token, you need to make sure that you use the DigitalOcean public API:

https://docs.digitalocean.com/reference/api/api-reference/

When using the public API, you should make sure that you pass the token as an Authorization: Bearer header:

curl -X GET \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
  "https://api.digitalocean.com/v2/domains/example.com/records"

On the other hand, if you are using the DigitalOcean OAuth API, you would need to make sure that you register your app and follow the steps here on how to use the client secret and client ID to dynamically generate access tokens: