Skip to content
DNSmigrator
betaDNS betaRegistrar betaRegistrarSetup guide checked 2026-09-27

Gandi LiveDNS

Gandi access token setup: create a short-lived Gandi personal access token for the correct organization and limit it to the domains and technical configuration this connection manages.

On this page

Gandi access token permissions

Credential type
Personal access token
Preview access
Manage domain name technical configurations (includes the required domain visibility)
Apply access
Manage domain name technical configurations
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

The registrar role uses the same permission to change nameservers and registry DNSSEC keys. Scope the token to the domains being moved; this integration does not use a separate read-only LiveDNS permission.

DNSControl id

creds.json TYPE
{
  "TYPE": "GANDI_V5"
}

Create credentials

Create a short-lived Gandi personal access token for the correct organization and limit it to the domains and technical configuration this connection manages.

Access you'll grant

Preview

Manage domain name technical configurations (includes the required domain visibility)

Apply

Manage domain name technical configurations

The registrar role uses the same permission to change nameservers and registry DNSSEC keys. Scope the token to the domains being moved; this integration does not use a separate read-only LiveDNS permission.

Before you start

  • A Gandi organization containing the domains or LiveDNS products you want to manage.
  • Permission to create a personal access token for that organization.
  • The token must cover the selected domain products and domain technical configuration; Gandi PATs cannot span organizations.

Setup steps

0 of 7 done

  1. Open personal access tokens

    Sign in to Gandi Admin and open the personal access token page. You can also go to ORGANIZATIONS → your organization → Sharing → Create a token.

    Open Gandi personal access tokens

  2. Choose the organization

    Select the organization that owns the domains. A PAT is tied to one organization and cannot be shared across several organizations.

  3. Set a short expiry

    Give the token a recognizable name and choose an Expires in value that covers the migration. Gandi currently offers 7, 30, 60, or 90 days, or 1 year.

  4. Limit the token to your domains

    Under token resources, choose Restrict to selected products and add only the domains you are moving. Use The whole organization only when that broader access is intentional.

  5. Grant technical configuration access

    Under domain permissions, enable Manage domain name technical configurations. It covers LiveDNS records and the registrar operations this connection performs.

    PermissionManage domain name technical configurations

  6. Create and copy the token

    Select Create, then use Copy before Done. Gandi shows the token once and cannot retrieve it later.

  7. Add the organization ID if needed

    Paste the token into Personal access token. If the zone list points at the personal organization instead of the intended organization, copy that organization's UUID from its Gandi Admin URL into Organization (sharing) ID.

Troubleshooting

Gandi rejected the token

The PAT is expired, revoked, or copied incompletely. Create another token and copy it before leaving the confirmation page.

`api-restricted`: the token lacks technical access

Create a PAT with Manage domain name technical configurations and include the affected domain in its selected resources.

The zone list is empty

The LiveDNS list defaults to the personal organization. Add the intended Organization (sharing) ID and confirm the PAT belongs to that same organization.

A legacy API key cannot be created

This is expected for accounts without an existing legacy key. Leave Legacy API key empty and create a personal access token instead.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
Personal access tokentokenOptionalThe one-time personal access token copied after creation. This is the recommended credential.
Legacy API keyapiKeyOptionalOnly for an existing legacy API key. Gandi has deprecated API keys and says new ones can no longer be created; use a PAT instead.
Organization (sharing) IDsharingIdOptionalOptional organization UUID used to select the organization whose domains LiveDNS should list.

Capabilities

Create zones
No
List zones
Yes
DNSSEC
Managed through the API
Minimum TTL
300 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • ALIAS
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • PTR
  • DS
  • DNAME
  • HTTPS
  • SVCB
  • TLSA
  • SSHFP
  • NAPTR
  • SPF
  • LOC
  • OPENPGPKEY
  • RP

Caveats

  • LiveDNS only hosts zones for domains in your Gandi organization, so zones can't be created for domains registered elsewhere.
  • ALIAS records are only allowed at the zone apex; TTLs must be between 300 seconds and 30 days.
  • Apex NS records are managed by Gandi and are left untouched.

Troubleshooting

Gandi rejected the token
The PAT is expired, revoked, or copied incompletely. Create another token and copy it before leaving the confirmation page.
`api-restricted`: the token lacks technical access
Create a PAT with **Manage domain name technical configurations** and include the affected domain in its selected resources.
The zone list is empty
The LiveDNS list defaults to the personal organization. Add the intended **Organization (sharing) ID** and confirm the PAT belongs to that same organization.
A legacy API key cannot be created
This is expected for accounts without an existing legacy key. Leave **Legacy API key** empty and create a personal access token instead.

Related links

Gandi LiveDNS migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → GandiRoute 53 → GandiAzure DNS → GandiCloud DNS → Gandi