DigitalOcean

F Paperspace (Machines, Notebooks, Deployments, Workflows; api.paperspace.com)

Paperspace, now part of DigitalOcean, still runs its own console and API with its own credential: a team API key made by hand in Team Settings. The docs describe no expiry, no scopes, no last-used view, no API to mint keys and no GitHub secret-scanning partnership; even the official GitHub Action takes the static key. Storage providers and private buckets also want pasted S3 keys. DigitalOcean's main API is graded separately.

Docs: docs.digitalocean.com · Checked 2026-10-22 · source YAML · dispute via PR

Inbound F

How a workload running anywhere authenticates to this product.

A static team-scoped API key created in the Paperspace console (Team Settings, API keys tab), sent as a bearer token to api.paperspace.com and used by the pspace CLI, the Gradient CLI and the Paperspace Deploy GitHub Action. No federation path is documented.

docs.digitalocean.com checked 2026-10-22
“API keys let you interact with Paperspace through the Core RESTful API, the Core JavaScript SDK, and Gradient command-line utility (CLI).”
docs.digitalocean.com checked 2026-10-22
“On the API keys tab, enter a name and click the Add button.”
docs.digitalocean.com checked 2026-10-22
“An API key or access token”
raw.githubusercontent.com checked 2026-10-22
“This may also be set using the `PAPERSPACE_API_KEY` environment variable.”

Paperspace keys are separate from DigitalOcean personal access tokens: different console, different API host, different key. The Paperspace Deploy GitHub Action is the documented CI path and reads a static key from GitHub secrets rather than exchanging the job's OIDC token. Core API endpoints were deprecated in July 2024; the current api.paperspace.com reference authenticates the same way. 0 of 5 hygiene checks pass, so F. Moving off F needs three of: enforced expiry, a key-management API, per-key scopes, a last-used column, and a GitHub secret-scanning partnership; moving to B or A needs federation.

Outbound B

How this product reaches into your cloud, repos, or other SaaS.

Gradient Workflows connect to GitHub through the Gradient GitHub App (install, keyless). Storage providers and private S3-compatible data sources (Spaces, AWS S3, GCS via its S3 endpoint) take a pasted access key and secret; private container registries take a pasted username and password.

docs.digitalocean.com checked 2026-10-22
“Select **Connect to GitHub**, and then follow the prompts to authorize GitHub to install Gradient.”
docs.digitalocean.com checked 2026-10-22
“Create a bucket within your storage provider with read/write credentials, such as an access key and secret key, for accessing the data.”
docs.digitalocean.com checked 2026-10-22
“If the bucket is private add an Access Key ID and Secret Access Key by choosing a Paperspace Secret in the drop-down.”
docs.digitalocean.com checked 2026-10-22
“The storage provider configuration”
docs.digitalocean.com checked 2026-10-22
“The password for the registry.”

Checked: Workflows GitHub integration (GitHub App, can be limited to chosen repos); Notebook and team storage providers (S3 config with accessKey/secretAccessKey); S3-compatible data sources for Notebooks (AWS S3, Spaces, GCS through its S3 endpoint, all by static key); container registries (username/password); the Deploy GitHub Action (inbound, not a reach-in). No AWS role, GCP impersonation or Azure federated credential option exists. The docs ask for read/write keys and give no least-privilege or rotation guidance. B rests on the rubric's rule that a consent app counts as keyless; every cloud path is a pasted key, so a reviewer reading B as "keyless on a cloud" would put this at F.

Hygiene for any static credential the product still issues

✗ Expiry enforceable	Key creation takes only a name; no expiry field, default or policy is documented. docs.digitalocean.com checked 2026-10-22 “Make sure to copy your new API key now.”
✗ Rotation via API	Keys are created and revoked in the console. The API reference covers team memberships and team secrets but has no API-key endpoints. docs.digitalocean.com checked 2026-10-22 “You can revoke your API keys by clicking revoke in the console.” docs.digitalocean.com checked 2026-10-22
✗ Scoped keys	A key carries its owner's access to the whole team; no per-key scopes or machine principal are documented. Team roles are member and admin only. docs.digitalocean.com checked 2026-10-22 “API Keys have team-scoped permissions and are associated with your user account.” docs.digitalocean.com checked 2026-10-22 “Team admins can change the roles of other team members.”
✗ Last-used visible	The key list is documented as showing names only; no last-used timestamp is described. docs.digitalocean.com checked 2026-10-22 docs.digitalocean.com checked 2026-10-22 “After the key is copied, the name of the key is available in the list of API Keys.”
✗ Leak revocation	Paperspace does not appear in GitHub's supported secret-scanning patterns table. The DigitalOcean rows cover DigitalOcean PATs, OAuth, refresh and system tokens, not Paperspace API keys. docs.github.com checked 2026-10-22

Notes

Split from digitalocean-api because Paperspace still has its own console, API host and key type after the acquisition; the DigitalOcean PAT's custom scopes, last-used view and GitHub partnership do not carry over. If Paperspace is folded into the DigitalOcean API and PATs, this card should be retired.

Badge

[![wif.tax grade](https://wif.tax/badge/paperspace.svg)](https://wif.tax/p/paperspace/)