--- schema_version: 1 route: /t/doctl.md tool: "doctl" --- # sincecutoff.com /t/doctl — doctl (DigitalOcean CLI) - name: doctl (DigitalOcean CLI) - kind: cli - children: none - homepage: Changes to the tools coding agents drive, since a model's training cutoff, each linked to its first-party source. Check installed versions and limitations before acting; a cutoff date does not establish what a model knows. Original editorial content: [Apache 2.0](https://sincecutoff.com/v1/data-license.txt), by [0xPatrick](https://0xpatrick.dev). Preserve applicable license and [NOTICE](https://sincecutoff.com/notice.txt) attribution when redistributing. Third-party source text and examples retain their own rights. [License scope and attribution](https://sincecutoff.com/v1/license.json). To stay current, read the changes feed: [`/v1/changes.md?tool=doctl`](https://sincecutoff.com/v1/changes.md?tool=doctl) (or `.json`), adding `since=YYYY-MM-DD` for your training cutoff. Entries for registered children are included; the registry itself is `/v1/tools.json`. How to page and save your place: [llms.txt](https://sincecutoff.com/llms.txt). ### doctl auth login signs in through browser OAuth (2026-10-13) - slug: doctl-auth-login-signs-in-through-browser-oauth-297b73ef28e6 - score: 0.96 How to use it: When authenticating doctl for repository work, run `doctl auth login` to approve browser OAuth, or `doctl auth init` to enter an API token; credentials are stored in an authentication context. Use `--no-browser`, `--timeout`, `--scopes`, `--save-scope`, or `--context ` to adjust browser sign-in as needed. Examples: ``` doctl auth login ``` ``` doctl auth login --scopes "read write" ``` ``` doctl auth init ``` - why_it_matters: Authenticate doctl for repository work by signing in through a browser or supplying an API token. - sources: , , - gotchas: "Version: v1.184.0"; "--no-browser: Print the authorization URL instead of opening a browser."; "--timeout: Change how long the authorization link is valid; default is 5 minutes. Documented unit/value format not found."; "--scopes: Space-separated permissions requested up front, such as `read write` or `droplet:read account:read`; absent means choose permissions on the authorization screen."; "--save-scope: Persist `--scopes` as the default for later sign-ins; combine with `--scopes \"\"` to clear the saved default. No mutual-exclusion rule documented."; "--context : Save sign-in credentials to a named context; without it, credentials replace those in `default`, which is selected."; "API token (auth init prompt) (required): Enter the DigitalOcean access token generated in the Control Panel when prompted."; "Prerequisite: For `doctl auth init`, create an API token in the DigitalOcean Control Panel first."; "Prerequisite: Browser OAuth uses DigitalOcean's published doctl application; no app registration is needed."; "The authorization link is valid for 5 minutes unless changed with `--timeout`."; "Access tokens issued through browser sign-in are short-lived; doctl saves a refresh token and renews automatically when running a command."; "Sign in again to change granted scopes or if the session is revoked."; "Without `--context`, sign-in replaces credentials in the `default` context and selects it." ### doctl agents selects a sandbox image with --template (2026-10-01) - slug: doctl-agents-selects-a-sandbox-image-with-template-833307ca79be - score: 0.92 How to use it: When creating an agent with doctl v1.176.0, use `--template` to select the sandbox image; use `--template sandbox` to create a sandbox without an agent. The official documentation found does not provide the command’s full invocation. - why_it_matters: Create an agent using a specified sandbox image or a sandbox without an agent. - sources: - gotchas: "Version: v1.176.0"; "Docs conflict: The current official doctl reference documents `doctl harness-runtime create` and manifest-based sessions, not the card’s `doctl agents` interface: https://docs.digitalocean.com/reference/doctl/reference/harness-runtime/create/" ### doctl firewall rules support optional action (2026-09-18) - slug: doctl-firewall-rules-support-optional-action-f611339cdc1c - score: 0.97 How to use it: When adding cloud firewall rules with doctl v1.169.0, include `action:allow` or `action:deny` in each rule string to set its action; omitted action defaults to allow. Examples: ``` doctl compute firewall add-rules --inbound-rules "protocol:tcp,ports:22,address:,action:deny" ``` ``` doctl compute firewall add-rules --outbound-rules "protocol:tcp,ports:22,address:,action:allow" ``` - why_it_matters: Add inbound or outbound cloud firewall rules with an explicit allow or deny action. - before: Create rules without an explicit action, which use the API’s default-allow behavior. - sources: , , , - gotchas: "Version: v1.169.0"; " (required): Cloud firewall ID."; "--inbound-rules: Comma-separated rule keys; needs protocol, ports, and source location. Optional `action` accepts `allow` or `deny`; omitted defaults to allow. Supported source keys: address, droplet_id, load_balancer_uid, kubernetes_id, tag."; "--outbound-rules: Comma-separated rule keys; needs protocol, ports, and destination location. Optional `action` accepts `allow` or `deny`; omitted defaults to allow. Supported destination keys: address, droplet_id, load_balancer_uid, kubernetes_id, tag."; "action: Rule action: `allow` or `deny`. These are allowed values for the same key, not mutually exclusive fields."; "Prerequisite: Install doctl, create a DigitalOcean personal access token, then authorize doctl with `doctl auth init`."; "The action field is optional and defaults to allow on the API side."; "Existing commands and scripts that omit action continue to work unchanged."; "Docs conflict: A current DigitalOcean configure-rules page says doctl does not support `action` and recommends using the API for deny rules, conflicting with the v1.169.0 release note and the current add-rules CLI reference. That page does not establish behavior at v1.169.0; follow the version-specific release note." ### doctl prepayment config and status get commands (2026-09-18) - slug: doctl-prepayment-config-and-status-get-commands-563f5c77bc02 - score: 0.91 How to use it: To inspect the configured DigitalOcean account’s prepayment details, run the config command; to inspect its gate status and balances, run the status command. Examples: ``` doctl prepayment config ``` ``` doctl prepayment status ``` - why_it_matters: Check the configured DigitalOcean account’s prepayment configuration and status. - sources: , , , , - gotchas: "Version: v1.169.0"; "config command: No command-specific parameter is documented as required."; "status command: No command-specific parameter is documented as required."; "Prerequisite: Use an authenticated DigitalOcean token with the billing:read scope."; "Requires `billing:read`."; "The corresponding API endpoints are live in production."; "Docs conflict: Current CLI reference documents `doctl prepayment config` and `doctl prepayment status`; it does not document the card’s trailing `get` verbs. Since the reference is generated from doctl v1.180.0, after the card’s v1.169.0, the documented command forms may reflect a later interface." ### doctl secrets get supports --kvs (2026-09-18) - slug: doctl-secrets-get-supports-kvs-4695f2e754da - score: 0.97 How to use it: When you need a secret’s values as key-value pairs, run `doctl secrets get --region --kvs `. The `--kvs` flag reveals values as `KEY=VALUE` pairs; the release note says they print in alphabetical order. Examples: ``` doctl secrets get --region tor1 --kvs my-secret ``` - why_it_matters: Retrieve a secret’s values as key-value pairs for a development workflow. - sources: , , , - gotchas: "Version: v1.169.0"; " (required): Name of the secret container to retrieve."; "--region : Region where the secret is stored; the example uses `tor1`."; "--kvs: Reveal secret values as `KEY=VALUE` pairs. Defaults to false."; "Prerequisite: Install and configure doctl to use the CLI."; "Output values are always printed in alphabetical order."; "Docs conflict: The current DigitalOcean command reference is generated for doctl v2.0.0, newer than the card’s v1.169.0. It says `--kvs` takes precedence over other flags, a behavior not documented in the v1.169.0 release note; that newer-version behavior is not included here." ### doctl adds GradientAI simulation APIs (2026-08-31) - slug: doctl-adds-gradientai-simulation-apis-37bc9fe2a74d - score: 0.95 How to use it: When working with GradientAI scenarios or simulations in doctl v1.168.0, choose the command for the operation: use `scenario-set` to manage scenario sets and `simulation-run` to run or inspect simulations. Examples: ``` doctl gradient scenario-set list --statuses ready ``` ``` doctl gradient simulation-run list --statuses running ``` ``` doctl gradient simulation-run get -o json ``` - why_it_matters: When working with GradientAI scenarios or simulations through doctl, inspect the added simulation API commands and use the command that matches the operation you need. - sources: , , , , - gotchas: "Version: v1.168.0"; "`` (required): UUID of the simulation run to retrieve."; "`--statuses`: Filters runs by status; documented values include `running`."; "`-o json`: Selects JSON output; the get command documentation says this also shows per-scenario results."; "Prerequisite: Authenticate doctl with a DigitalOcean API V2 access token; the command reference lists `--access-token` / `-t` as a global flag." ### doctl databases configuration get and update support advanced_mysql (2026-07-31) - slug: doctl-databases-configuration-get-and-update-support-advanced-mysql-cf987d403b8a - score: 0.97 How to use it: When inspecting or changing an Advanced MySQL cluster, use `doctl databases configuration get` to retrieve its configuration or `doctl databases configuration update` to patch specified fields. Examples: ``` doctl databases configuration get --engine advanced_mysql -o json --access-token ``` ``` doctl databases configuration update --engine advanced_mysql --config-json '{"mysql_parameters":{"max_connections":"200"}}' --access-token ``` - why_it_matters: Inspect or update an advanced MySQL database cluster's configuration. - sources: , , , , - gotchas: "Version: v1.166.0"; " (required): Database cluster ID in UUID format."; "--engine (required): Database engine; use `advanced_mysql` for MySQL Advanced Edition."; "-o json: Select JSON output; `--output` accepts `text` or `json`."; "--config-json (required): JSON object containing the desired cluster configuration; update is a PATCH, so unspecified fields are unchanged."; "mysql_parameters: Nested configuration object shown in the release-note example; official docs read here do not document its sub-keys or mutual exclusivity."; "--access-token: API v2 access token; doctl can instead use initialized authentication."; "Prerequisite: Install doctl and authenticate with a DigitalOcean API token; alternatively provide `--access-token` on each command." ### doctl adds NFS access point commands (2026-07-23) - slug: doctl-adds-nfs-access-point-commands-836e33eec2f8 - score: 0.97 How to use it: When managing an NFS share access point, use `doctl nfs access-point` commands. Create one with its share ID, name, export path, and VPC ID; use `list`, `get`, or `delete` to inspect or remove access points. Examples: ``` doctl nfs access-point create --share-id --name --path --vpc-id ``` ``` doctl nfs access-point list --share-id [--status ] ``` ``` doctl nfs access-point get --id ``` - why_it_matters: Manage an NFS access point from a coding workflow. - sources: , , , - gotchas: "Version: v1.164.0"; "--share-id (required): ID of the NFS share."; "--name / -n (required): Access point name."; "--path (required): Export path; must start with `/`."; "--vpc-id (required): VPC ID for the access point."; "--protocols: Allowed protocols (`NFS`, `NFS4`); default `NFS4`."; "--squash-config: Squash mode (`NO_SQUASH`, `ROOT_SQUASH`, `ALL_SQUASH`); default `ROOT_SQUASH`."; "--anonuid: Anonymous UID for squashed users; default `65534`."; "--anongid: Anonymous GID for squashed users; default `65534`."; "--identity-enforcement-enabled: Enable identity enforcement for the export; default `false`."; "--status: Optional list filter: `ACCESS_POINT_CREATING`, `ACCESS_POINT_ACTIVE`, `ACCESS_POINT_FAILED`, or `ACCESS_POINT_DELETED`."; "--id (required): Access point ID; used by `get` and `delete`."; "Prerequisite: Authenticate doctl with a DigitalOcean API access token." ### doctl exposes CoreDNS Autoscaler toggle for DOKS cluster create/update (2026-06-09) - slug: doctl-exposes-coredns-autoscaler-toggle-for-doks-cluster-create-update-64734330d117 - score: 0.95 How to use it: When creating or updating a DOKS cluster, set the CoreDNS Autoscaler explicitly with `--enable-coredns-autoscaler=true` or `false`; if omitted, the API applies a Kubernetes-version-specific default. [doctl v1.161.0 source](https://github.com/digitalocean/doctl/blob/v1.161.0/commands/kubernetes.go) Examples: ``` doctl kubernetes cluster create --region --version --enable-coredns-autoscaler=true ``` ``` doctl kubernetes cluster update --enable-coredns-autoscaler=true ``` - why_it_matters: Create or update a DOKS cluster with the CoreDNS Autoscaler setting configured. - sources: , , - gotchas: "Version: v1.161.0"; "--enable-coredns-autoscaler: Boolean toggle. `true` enables CoreDNS Autoscaler; `false` disables it. If omitted, the API applies a version-specific default: true for Kubernetes 1.36.0 or later, false for older versions."; " (required): Name for the cluster being created."; " (required): Existing cluster identifier or name to update."; "--region: Region for the cluster; the source example supplies a region."; "--version: Kubernetes version for the cluster; the source example supplies a version." ### doctl databases storage-autoscale get and update (2026-06-03) - slug: doctl-databases-storage-autoscale-get-and-update-a298ec9097fa - score: 0.97 How to use it: To inspect a database cluster’s storage autoscaling settings, run `doctl databases storage-autoscale get `. To update them, run `doctl databases storage-autoscale update --enabled `; when enabling, you may also set the threshold percentage and GiB increment. Examples: ``` doctl databases storage-autoscale get ``` ``` doctl databases storage-autoscale update --enabled true --threshold-percent 60 --increment-gib 40 ``` - why_it_matters: Inspect or update storage autoscaling options for a database cluster. - sources: , , , , - gotchas: "Version: v1.160.1"; " (required): ID of the database cluster to inspect or update."; "--enabled (required): Enable or disable storage autoscaling; value must be `true` or `false`."; "--threshold-percent: Storage usage percentage that triggers autoscaling; used when enabled. Current docs give a default of 80 when omitted."; "--increment-gib: Storage in GiB to add when autoscaling triggers; used when enabled. Current docs give a default of 10 when omitted."; "--access-token: API v2 access token; alternatively authenticate doctl with an API token."; "--api-url: Override the default API endpoint."; "Prerequisite: Install doctl and authenticate it with a DigitalOcean API token. The install guide says to create a token with read and write access." ### doctl serverless inference endpoints support (2026-06-03) - slug: doctl-serverless-inference-endpoints-support-29ce85e42aa7 - score: 0.91 How to use it: When developing or testing code that needs model inference, use doctl’s serverless inference commands to call the endpoint. For a chat prompt, run `doctl inference chat-completions create` with a model and message, or provide a full JSON request. Examples: ``` doctl inference chat-completions create --model --message "" ``` - why_it_matters: Call a serverless inference endpoint while developing or testing code with doctl. - sources: , , - gotchas: "Version: v1.160.1"; "--model (required): Model ID; required unless `--request` is set. `-m` is an alias."; "--message (required): User message; required unless `--request` is set."; "--request: Path to a JSON request body; use `-` for stdin. When set, `--model` and `--message` are not required."; "--stream: Stream output using server-sent events."; "--access-token (required): Inference credential: a Model Access Key or a DigitalOcean PAT with full access scope."; "Prerequisite: Authenticate with `--access-token` using a Gradient Model Access Key or a DigitalOcean PAT with full access; limited scopes do not work for serverless inference."; "Inference APIs require a DigitalOcean PAT with full access scope or a Gradient Model Access Key; a limited-scope PAT results in 401 for inference calls."; "Docs conflict: The current DigitalOcean CLI reference documents `doctl serverless-inference`; the v1.160.1 source documents `doctl inference` and shows the chat-completions invocation. The current reference is generated from doctl v2.0.0, so its command naming is newer than the card version." ### doctl dedicated-inference endpoints and tokens commands (2026-03-31) - slug: doctl-dedicated-inference-endpoints-and-tokens-commands-1bdf86bd6417 - score: 0.90 How to use it: When managing a dedicated inference endpoint from a repository workflow, use the `doctl dedicated-inference` command group. Update it with a JSON or YAML spec using `--spec` (use `-` for stdin), and optionally pass a Hugging Face token for gated models. Examples: ``` doctl dedicated-inference update --spec ``` ``` doctl dedicated-inference update --spec --hugging-face-token "" ``` ``` cat | doctl dedicated-inference update --spec - ``` - why_it_matters: Create, inspect, list, update, or manage a dedicated inference endpoint from a repository workflow. - sources: , , - gotchas: "Version: v1.154.0"; " (required): ID of the endpoint to update."; "--spec (required): Path to a JSON or YAML spec; `-` reads it from stdin."; "--hugging-face-token: Hugging Face token for accessing gated models."; "--format: Comma-separated output columns. Allowed: `ID`, `Name`, `Region`, `Status`, `VPCUUID`, `PublicEndpoint`, `PrivateEndpoint`, `CreatedAt`, `UpdatedAt`."; "Prerequisite: Authenticate `doctl` with a DigitalOcean API V2 access token."; "Update requires a dedicated inference ID argument; the command returns an error when it is missing."; "Docs conflict: Current CLI reference is generated from doctl v1.169.0, later than the card's v1.154.0. It documents the same update interface, but does not establish the v1.154.0 behavior for every operation in the card." ### doctl droplets create adds --public-networking (2026-03-31) - slug: doctl-droplets-create-adds-public-networking-0e4b16fc665b - score: 0.92 How to use it: When creating a Droplet, set public networking explicitly with the documented doctl flag; `false` disables it and `true` enables it. Examples: ``` doctl compute droplet create --size --image --enable-public-networking=false ``` - why_it_matters: Create a droplet with a chosen public-networking setting. - sources: , , , - gotchas: "Version: v1.154.0"; "--enable-public-networking: Enables public networking; default is true. Set false to disable it."; " (required): Name for the new Droplet."; "--size (required): Droplet size slug."; "--image (required): Image ID or slug for the Droplet."; "Prerequisite: Install doctl and authenticate it with `doctl auth init`."; "Prerequisite: Creating Droplets requires the `droplet:create` scope and its listed required scopes."; "Docs conflict: The supplied v1.154.0 release note names `--public-networking`; the current doctl CLI reference (generated for v2.0.0) documents `--enable-public-networking`. The current docs do not establish the v1.154.0 flag spelling or behavior." ### doctl apps adds autoscaling event commands and logs (2026-03-18) - slug: doctl-apps-adds-autoscaling-event-commands-and-logs-f62e55976c4b - score: 0.95 How to use it: For an App Platform app, use `list-events` to inspect events; use `cancel-event` with the app and event IDs to cancel an in-progress autoscaling event. To retrieve event logs, pass the event ID to `apps logs` and set the type to `autoscale_event`. Examples: ``` doctl apps list-events ``` ``` doctl apps cancel-event

``` ``` doctl apps logs

--event-id --type autoscale_event ``` - why_it_matters: Inspect an App Platform app's autoscaling events, cancel one, or retrieve its event logs. - sources: , , , , - gotchas: "Version: v1.152.0"; " (required): App ID; required by the list-events and cancel-event command syntax."; " (required): Event ID used by cancel-event; with logs, supplied as the value of `--event-id`."; ": Component whose logs to retrieve; defaults to all components."; "--event-id: Selects logs for a specific autoscaling event ID."; "--type: Selects the log type; defaults to `run`. `autoscale_event` is a supported type."; "Docs conflict: The current official CLI reference pages are generated from doctl v1.178.0, v1.173.0, and v2.0.0, later than the card’s v1.152.0; exact v1.152.0 command details could not be verified from those pages." ### doctl apps adds cancel-job-invocation (2026-01-22) - slug: doctl-apps-adds-cancel-job-invocation-72a21719746d - score: 0.93 How to use it: When you need to cancel a specific App Platform job invocation, run `doctl apps cancel-job-invocation` with the app ID and job invocation ID. Examples: ``` doctl apps cancel-job-invocation ``` - why_it_matters: Cancel a job invocation for a DigitalOcean app. - sources: , , , , - gotchas: "Version: v1.149.0"; " (required): ID of the app."; " (required): ID of the job invocation to cancel."; "Prerequisite: Authenticate doctl with a DigitalOcean API token or provide one with the global `--access-token` flag."