> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.detectant.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.detectant.com/_mcp/server.

# Connect DigitalOcean Spaces

Detectant connects to private DigitalOcean Standard and Cold Storage Spaces
with a limited-access read key. It derives the origin endpoint and signing
region from the selected region and never needs CDN or write access.

## Before you connect

1. In DigitalOcean Control Panel, open **Spaces Object Storage → Access Keys**.
2. Create a dedicated key and choose **Limited access**.
3. Select only the Space to monitor and grant **Read** permission.
4. Save the secret when it is shown. DigitalOcean does not show it again.

Detectant needs to list the Space and read object metadata and content. It does
not create, change or delete objects. DigitalOcean does not allow
limited-access keys and bucket policies on the same Space.

Supported regions are `nyc3`, `ams3`, `sfo2`, `sfo3`, `sgp1`, `lon1`, `fra1`,
`tor1`, `blr1`, `syd1`, `atl1`, `ric1`, `mkc1` and `mem1`.

## Connect the Space

In **Dashboard → Integrations**, choose **Add integration**, select
**DigitalOcean**, then enter the exact region, Space name, optional prefix,
access key ID and secret access key.

Use the Space name, not its complete URL. Detectant derives the regional origin
endpoint. Do not enter a CDN endpoint or custom CDN hostname.

Choose **New files only** to inventory existing objects without scanning them.
Choose **Existing and new files** to preview the eligible existing-object count
and remaining monthly allowance. Existing objects are not released for scanning
until you confirm the preview.

Setup verifies listing access. For a non-empty scope, it also verifies object
metadata and content reads. Credentials are encrypted and never returned.

## Monitoring behavior

DigitalOcean does not provide a suitable native object-created notification,
so Detectant checks the configured scope every five minutes. Very large Spaces
and temporary provider failures can take longer. New or changed objects are
scanned once; unchanged objects are not rescanned. Directory-marker objects are
ignored.

* **Baselining:** Detectant is building the initial inventory.
* **Healthy:** The baseline or latest check completed. The dashboard shows the
  last and next check.
* **Temporary failure:** A provider or network request failed. Detectant keeps
  the last successful check visible and retries with bounded backoff.
* **Credentials rejected:** Replace revoked, incorrect or insufficient
  credentials.
* **Object limit exceeded:** The scope exceeds the first-release limit of
  100,000 listed entries. Use a narrower prefix or Space.
* **Allowance paused:** Queued scans resume at the next billing-period boundary
  without downloading object content first.

Deleting an object removes it from the current inventory. Uploading the same
key again makes its current revision eligible. Detectant does not enumerate
historical versions.

## Object size and storage type

Storage objects can be up to **500 MB on Free** and **2 GB on paid plans**.
These limits are separate from direct API uploads. Larger objects are recorded
as too large without being scanned.

Standard and Cold Storage use the same read-only connection. DigitalOcean
applies lower request limits to Cold Storage, and object reads can incur
retrieval charges. Detectant never changes a Space's storage type.

## Rotate credentials

Create or update a dedicated Read key, then use **Manage → Replace credentials**
on the integration. Detectant verifies the replacement before storing it and
schedules an immediate check. Revoke the old key after the replacement
succeeds.

## Troubleshooting

* Confirm the selected region and Space name match the origin endpoint shown by
  DigitalOcean.
* Confirm the key has **Read** permission for the exact Space.
* If an empty scope connects but new objects cannot be scanned, verify object
  read permission and the configured prefix.
* Check the plan's object-size limit, monthly allowance and the integration's
  **Last checked** status when objects are missing.
* After rotating a key, use **Replace credentials** instead of deleting the
  integration.

See DigitalOcean's guides for [managing Spaces access keys](https://docs.digitalocean.com/products/spaces/how-to/manage-access/),
[Spaces limits](https://docs.digitalocean.com/products/spaces/details/limits/)
and [regional availability](https://docs.digitalocean.com/products/spaces/details/availability/).