Skip to content
DNSmigrator
betaDNS betaRegistrar betaRegistrarSetup guide checked 2026-09-27

DNSimple

DNSimple API token setup: create an account token scoped to the zones you will manage and, for registrar cutover, the registered domains whose nameservers and DS records may change.

On this page

DNSimple API token permissions

Credential type
Account API access token
Preview access
Zones → Read only
Apply access
Zones → Full access
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

For registrar cutover, also grant Domains → Read only and Registrar → Full access for the registered domains. DNSMigrator requires an account token—not a user token—for registrar operations.

DNSControl id

creds.json TYPE
{
  "TYPE": "DNSIMPLE"
}

Create credentials

Create an account token scoped to the zones you will manage and, for registrar cutover, the registered domains whose nameservers and DS records may change.

Access you'll grant

Preview

Zones → Read only

Apply

Zones → Full access

For registrar cutover, also grant Domains → Read only and Registrar → Full access for the registered domains. DNSMigrator requires an account token—not a user token—for registrar operations.

Before you start

  • Administrator access to the DNSimple account.
  • A Teams plan or higher to create a least-privilege scoped token; Solo account tokens have full account permissions.
  • The domain must already be in the DNSimple account, and must be registered there for registrar cutover.

Setup steps

0 of 6 done

  1. Open API & Access

    Select the account you want to connect, then choose API & Access in the account navigation.

    DNSimple API access token guide

  2. Add an account token

    Select Add, enter a name for this DNSMigrator connection, and keep this as an account token. Do not use User access tokens when the connection will act as a registrar.

  3. Choose scoped permissions

    On Teams plans and above, set Zones to Read only for previews or Full access for apply, then select Change to limit access to the target zones. For registrar cutover, also set Domains to Read only and Registrar to Full access for the registered domains.

    PreviewZones → Read only
    ApplyZones → Full access
    Registrar cutoverDomains → Read only + Registrar → Full access

  4. Generate and copy the token

    Select Generate token and copy the value immediately. DNSimple shows it only once.

  5. Leave Account ID empty for an account token

    DNSMigrator reads the account ID from an account token. Only a DNS-only user token may need Account ID; find it in the selected account URL as the digits after /a/, for example app.dnsimple.com/a/1234/domains.

  6. Use sandbox only with a sandbox account

    Leave Use the sandbox API off for production. Turn it on only for a separate sandbox.dnsimple.com account and a token generated there.

    DNSimple sandbox

Troubleshooting

A user token can access several accounts

Enter the numeric Account ID from the target account URL, or replace it with the recommended account token.

Registrar access rejects a user token

Create an account token under the target account's API & Access page. DNSMigrator intentionally requires an account token for registrar changes.

Permission Denied

For DNS changes, change Zones from Read only to Full access. For cutover, add Registrar Full access and Domains Read only for the registered domain.

The token is unauthorized

The token may be incomplete, disabled, deleted, or from the other environment. Generate a replacement and verify the sandbox setting.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
API access tokentokenRequiredThe one-time value shown after you select Generate token on the account's API & Access page.
Account IDaccountIdOptionalUsually blank for an account token. For a DNS-only user token, use the numeric ID after /a/ in the selected account URL.
Use the sandbox APIsandboxOptionalOff for app.dnsimple.com credentials. Turn on only for a token from a separate sandbox.dnsimple.com account.

Capabilities

Create zones
No
List zones
Yes
DNSSEC
Managed through the API
Minimum TTL
60 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • PTR
  • ALIAS
  • DS
  • HTTPS
  • SVCB
  • TLSA
  • SSHFP
  • NAPTR
  • SPF

DNSimple-only types

  • URL

These records need translation or review when you move to another provider.

Caveats

  • Add the domain to your DNSimple account before migrating; zones can't be created through this connection.
  • Apex NS and SOA records are managed by DNSimple and can't be changed.
  • ALIAS, URL and some record types depend on your DNSimple plan.

Troubleshooting

A user token can access several accounts
Enter the numeric Account ID from the target account URL, or replace it with the recommended account token.
Registrar access rejects a user token
Create an account token under the target account's API & Access page. DNSMigrator intentionally requires an account token for registrar changes.
Permission Denied
For DNS changes, change Zones from Read only to Full access. For cutover, add Registrar Full access and Domains Read only for the registered domain.
The token is unauthorized
The token may be incomplete, disabled, deleted, or from the other environment. Generate a replacement and verify the sandbox setting.

Related links

DNSimple migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → DNSimpleRoute 53 → DNSimpleAzure DNS → DNSimpleCloud DNS → DNSimple