> ## Documentation Index
> Fetch the complete documentation index at: https://docs.knoxcall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# DigitalOcean (Static-IP Egress)

> The DigitalOcean API token KnoxCall uses to create static-IP egress servers — custom token scopes, the project and control-plane tag fields, and why a tag beats an IP list.

# DigitalOcean (Static-IP Egress)

[Egress routing](/infrastructure/egress-routing) can give a route a fixed public address your upstream can allowlist. KnoxCall provisions the droplet, reserved IP and firewall for that on a DigitalOcean account — this card holds the token it does it with.

**Scope: Global defaults** only. On KnoxCall Cloud this is KnoxCall's account. A self-hosted deployment that wants static-IP egress uses its own DigitalOcean account here.

## 1. In DigitalOcean

1. **API → Tokens → Generate New Token**.
2. **Custom Scopes** — enough is: `droplet` create/read/delete · `reserved_ip` create/read/update · `firewall` create/read/update · `project` read/update. A legacy *Read + Write* token also works but grants the whole account.
3. Pick an **expiry** and diary it: an expired token fails at provisioning time, not at save time.
4. Copy the token (`dop_v1_…`) — shown once.
5. Optional but recommended: **tag the droplet that runs KnoxCall** (e.g. `knoxcall-control-plane`). The egress firewall admits port 8443 only from droplets carrying that tag — the tag *is* the allowlist, so do not reuse it for anything else.

## 2. Enter it in KnoxCall

**Settings → Integrations → Global defaults → DigitalOcean** → *Configure*:

| Field                            | Value                                                                                                                                                            |
| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **API token**                    | `dop_v1_…`                                                                                                                                                       |
| **Project ID** *(optional)*      | Groups the created resources under one DigitalOcean project                                                                                                      |
| **Control-plane droplet tag**    | The tag from step 5. Preferred over IPs — it survives the control-plane address changing.                                                                        |
| **Control-plane IPs (fallback)** | Comma-separated, only when KnoxCall does not run on a droplet in this account. If the address changes, every egress server silently stops accepting connections. |

**Save credentials.**

## 3. Verify

Provision one egress server from **Egress**, confirm it comes up with a reserved IP, route a test request through it, then delete it. A bad token fails on the firewall listing call first.

## Things that bite

* **Prefer the tag.** A stale IP list is the failure mode that looks like a healthy egress server refusing every connection.
* **Environment fallback.** With no stored token a self-hosted host falls back to `DO_API_TOKEN`, so a deleted row does not necessarily disable provisioning.
* **Costs are yours**: each egress server is a droplet plus a reserved IP on your account.

## Related

* [Egress routing](/infrastructure/egress-routing)