Skip to content
DNSmigrator
betaDNS betaDNS hostingSetup guide checked 2026-09-27

DNScale

DNScale API key setup: create a zone-bounded DNScale API key with read scopes for preview and only the write scopes needed for apply.

On this page

DNScale API key permissions

Credential type
API key
Preview access
zones:read + records:read + dnssec:read
Apply access
zones:read + records:read + records:write
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

Add zones:write only to create zones. Add dnssec:read and dnssec:write when DNSMigrator should inspect and change DNSSEC.

DNSControl id

creds.json TYPE
{
  "TYPE": "DNSCALE"
}

Create credentials

Create a zone-bounded DNScale API key with read scopes for preview and only the write scopes needed for apply.

Access you'll grant

Preview

zones:read + records:read + dnssec:read

Apply

zones:read + records:read + records:write

Add zones:write only to create zones. Add dnssec:read and dnssec:write when DNSMigrator should inspect and change DNSSEC.

Before you start

  • A DNScale account; every current plan, including Free, includes API access.
  • Access to the zones you want to connect, or zones:write if DNSMigrator should create them.

Setup steps

0 of 6 done

  1. Open API Keys

    In the DNScale Dashboard, open Settings → API Keys, then select Create API Key.

    Open the DNScale dashboard

  2. Name the key and grant preview scopes

    Enter a name, then select zones:read, records:read, and dnssec:read for a complete preview including DNSSEC state.

    Zoneszones:read
    Recordsrecords:read
    DNSSECdnssec:read

  3. Add only the required write scopes

    For record apply, add records:write. Add zones:write only when DNSMigrator should create a missing zone, and add dnssec:write only when it should enable or disable DNSSEC.

    Record applyrecords:write
    Create zoneszones:write
    Change DNSSECdnssec:write

  4. Limit the resource boundary

    Choose the target zones in the zone/DNS-name boundary. Use whole-zone record access for migrations; a names-only boundary hides other records and prevents zone-level DNSSEC and zone operations.

  5. Create and copy the key

    Create the key and copy it immediately. DNScale shows the secret value only once, and the resource boundary cannot be edited later; rotate to a new key to change it.

  6. Paste the key

    Paste the complete value into API key, then check access.

Troubleshooting

DNScale rejected the API key

The key is incomplete, deleted, or from a different account. Create a replacement and copy the full one-time value.

The key lacks access to a zone or record

Create a replacement key whose zone boundary includes that zone and whose record_access covers all names needed by the migration.

Preview works but apply returns 403

Add records:write for record changes, zones:write for zone creation, or dnssec:write for DNSSEC changes, then use the replacement key.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
API keyapiKeyRequiredThe one-time secret value shown after Settings → API Keys → Create API Key.

Capabilities

Create zones
Yes
List zones
Yes
DNSSEC
Managed through the API
Minimum TTL
300 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • PTR
  • ALIAS
  • TLSA
  • SSHFP
  • HTTPS
  • SVCB

Caveats

  • TTLs must be between 300 and 86400 seconds.
  • The API is rate limited to 100 requests per minute, so large zones apply slowly (one request per record value).
  • Disabled records are not migrated.

Troubleshooting

DNScale rejected the API key
The key is incomplete, deleted, or from a different account. Create a replacement and copy the full one-time value.
The key lacks access to a zone or record
Create a replacement key whose zone boundary includes that zone and whose record_access covers all names needed by the migration.
Preview works but apply returns 403
Add records:write for record changes, zones:write for zone creation, or dnssec:write for DNSSEC changes, then use the replacement key.

Related links

DNScale migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → DNScaleRoute 53 → DNScaleAzure DNS → DNScaleCloud DNS → DNScale