Integration guides

Connect DigitalOcean Spaces

Detectant connects to private DigitalOcean Standard and Cold Storage Spaces with a limited-access read key. It derives the origin endpoint and signing region from the selected region and never needs CDN or write access.

Before you connect

  1. In DigitalOcean Control Panel, open Spaces Object Storage → Access Keys.
  2. Create a dedicated key and choose Limited access.
  3. Select only the Space to monitor and grant Read permission.
  4. Save the secret when it is shown. DigitalOcean does not show it again.

Detectant needs to list the Space and read object metadata and content. It does not create, change or delete objects. DigitalOcean does not allow limited-access keys and bucket policies on the same Space.

Supported regions are nyc3, ams3, sfo2, sfo3, sgp1, lon1, fra1, tor1, blr1, syd1, atl1, ric1, mkc1 and mem1.

Connect the Space

In Dashboard → Integrations, choose Add integration, select DigitalOcean, then enter the exact region, Space name, optional prefix, access key ID and secret access key.

Use the Space name, not its complete URL. Detectant derives the regional origin endpoint. Do not enter a CDN endpoint or custom CDN hostname.

Choose New files only to inventory existing objects without scanning them. Choose Existing and new files to preview the eligible existing-object count and remaining monthly allowance. Existing objects are not released for scanning until you confirm the preview.

Setup verifies listing access. For a non-empty scope, it also verifies object metadata and content reads. Credentials are encrypted and never returned.

Monitoring behavior

DigitalOcean does not provide a suitable native object-created notification, so Detectant checks the configured scope every five minutes. Very large Spaces and temporary provider failures can take longer. New or changed objects are scanned once; unchanged objects are not rescanned. Directory-marker objects are ignored.

  • Baselining: Detectant is building the initial inventory.
  • Healthy: The baseline or latest check completed. The dashboard shows the last and next check.
  • Temporary failure: A provider or network request failed. Detectant keeps the last successful check visible and retries with bounded backoff.
  • Credentials rejected: Replace revoked, incorrect or insufficient credentials.
  • Object limit exceeded: The scope exceeds the first-release limit of 100,000 listed entries. Use a narrower prefix or Space.
  • Allowance paused: Queued scans resume at the next billing-period boundary without downloading object content first.

Deleting an object removes it from the current inventory. Uploading the same key again makes its current revision eligible. Detectant does not enumerate historical versions.

Object size and storage type

Storage objects can be up to 500 MB on Free and 2 GB on paid plans. These limits are separate from direct API uploads. Larger objects are recorded as too large without being scanned.

Standard and Cold Storage use the same read-only connection. DigitalOcean applies lower request limits to Cold Storage, and object reads can incur retrieval charges. Detectant never changes a Space’s storage type.

Rotate credentials

Create or update a dedicated Read key, then use Manage → Replace credentials on the integration. Detectant verifies the replacement before storing it and schedules an immediate check. Revoke the old key after the replacement succeeds.

Troubleshooting

  • Confirm the selected region and Space name match the origin endpoint shown by DigitalOcean.
  • Confirm the key has Read permission for the exact Space.
  • If an empty scope connects but new objects cannot be scanned, verify object read permission and the configured prefix.
  • Check the plan’s object-size limit, monthly allowance and the integration’s Last checked status when objects are missing.
  • After rotating a key, use Replace credentials instead of deleting the integration.

See DigitalOcean’s guides for managing Spaces access keys, Spaces limits and regional availability.