nullcipher

DigitalOcean tokens (dop_v1_, doo_v1_, dor_v1_)

dop_v1_ (personal access token), doo_v1_ (OAuth access token) or dor_v1_ (OAuth refresh token) followed by exactly 64 hexadecimal digits. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: DigitalOcean token

What an AI chat would receive after masking

# EXAMPLE, not a real token
DIGITALOCEAN_TOKEN=[DIGITALOCEAN_PAT_1]

1 × DigitalOcean token found and masked.

How nullcipher recognises it

Checked only when the text contains “dop_v1_” (any case). Pattern (gitleaks rule digitalocean-pat, v8.30.1, translated to JavaScript): /\b(dop_v1_[0-9a-f]{64})(?:[\s"';`]|\\[nr]|$)/ — the first capture group is masked; any surrounding key name stays readable. The masked part must have a Shannon entropy above 3 bits per character, so repetitive placeholders like xxxx are left alone.

This is the rule text of the “DigitalOcean personal access token” detector in the masking engine, copied from the engine when this page was built; the rule is ported from gitleaks’ default rule set (MIT licence; version, skipped rules and changes). Detectors run in a fixed order and, where two overlap, the earlier one wins.

The same page covers 2 more rules, each with its own placeholder:

DigitalOcean access token — [DIGITALOCEAN_ACCESS_TOKEN_1]
Checked only when the text contains “doo_v1_” (any case). Pattern (gitleaks rule digitalocean-access-token, v8.30.1, translated to JavaScript): /\b(doo_v1_[0-9a-f]{64})(?:[\s"';`]|\\[nr]|$)/ — the first capture group is masked; any surrounding key name stays readable. The masked part must have a Shannon entropy above 3 bits per character, so repetitive placeholders like xxxx are left alone. (gitleaks rule)
DigitalOcean refresh token — [DIGITALOCEAN_REFRESH_TOKEN_1]
Checked only when the text contains “dor_v1_” (any case). Pattern (gitleaks rule digitalocean-refresh-token, v8.30.1, translated to JavaScript): /\b([Dd][Oo][Rr]_[Vv]1_[0-9A-Fa-f]{64})(?:[\s"';`]|\\[NRnr]|$)/ — the first capture group is masked; any surrounding key name stays readable. (gitleaks rule)

Example (fake)

# EXAMPLE, not a real token
DIGITALOCEAN_TOKEN=dop_v1_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef

nullcipher replaces it with [DIGITALOCEAN_PAT_1]. The 64 hex digits are 0-f four times. DigitalOcean never issued it.

Why it matters in an AI chat

A personal access token with write scope can create, resize and destroy Droplets, databases and Spaces in your team — which means both data loss and a bill: stolen cloud tokens are routinely used to start crypto-mining machines.

DigitalOcean now lets you create tokens with custom scopes, but it also says a token's scope cannot be edited after creation, so older full-access tokens stay full-access until you replace them.

Tokens turn up in Terraform variables, doctl configs and CI logs pasted into AI chats.

If it already leaked

  1. DigitalOcean's advice: if a token becomes compromised, delete it to revoke its access. In the control panel go to API → Tokens, open the token's menu and choose delete (the same menu also offers rename and regenerate). [1]
  2. Create a replacement with custom scopes limited to what the tool needs, and keep it in an environment variable rather than in code, as DigitalOcean recommends. [1]
  3. Check your team's resources and billing for Droplets or other resources you did not create while the token was exposed.

Sources

  1. How to create a personal access token — DigitalOcean Docs — checked 2026-09-25.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 229 detectors, with a page for 46 secret types, and how to delete a chat you already sent.