Gcore DNS
Gcore API token setup: create a permanent Gcore API token and select the lowest account role, while accounting for Managed DNS's unrestricted role behavior.
On this page
Gcore API token permissions
- Credential type
- Permanent API token
- Preview access
- **Users** — lowest role, but Managed DNS remains writable
- Apply access
- **Users** — Managed DNS roles do not restrict write actions
- API endpoint
- DNSMigrator uses the provider's fixed API endpoint.
Additional access
DNSControl id
{
"TYPE": "GCORE"
}Create credentials
Create a permanent Gcore API token and select the lowest account role, while accounting for Managed DNS's unrestricted role behavior.
Access you'll grant
Users — lowest role, but Managed DNS remains writable
Users — Managed DNS roles do not restrict write actions
Before you start
- A non-reseller Gcore account with Managed DNS access; reseller accounts cannot create API tokens.
- A user allowed to create a token with at least the Users role.
Setup steps
0 of 5 done
Open API tokens
In the Gcore Customer Portal, select your avatar → Profile → API tokens.
Start a token
Select Create token, enter a required Name, and optionally add a Description.
Choose expiration and roles
Under Expiration, choose Never expire or Set expiration date. When the dialog asks for product roles, choose Users for Managed DNS and unrelated products; it is the lowest role, although Gcore states that roles do not restrict Managed DNS.
Lowest roleUsersCreate and copy the token
Select Create, copy the generated token immediately, then select OK, I’ve copied token. Gcore displays the token only once.
Paste the token
Paste the value into Permanent API token here. Current examples use an underscore, such as
1234_abcdef; do not includeAPIKeyorapikey.
Troubleshooting
The portal does not offer API token creation
Reseller accounts cannot create permanent API tokens. Use an eligible customer account with Managed DNS access.
Gcore rejects the credential
Use the permanent token shown once after Create, not a one-hour Bearer token, and paste it without the APIKey prefix.
A Users token can still change DNS
This is documented Gcore behavior: account roles do not apply to Managed DNS, so no role produces a true preview-only DNS token.
The token suddenly expires
Check the token's Expiration setting or create a replacement with a date that covers the migration.
Official documentation
Guide checked against the official documentation on .
Credential fields
| Field | Requirement | Where to find it |
|---|---|---|
| Permanent API tokenapiKey | Required | The one-time permanent API token, typically in the form 1234_…; paste it without an APIKey prefix. |
Capabilities
- Create zones
- Yes
- List zones
- Yes
- DNSSEC
- Managed through the API
- Minimum TTL
- 60 seconds
- Apex CNAME
- Supported through flattening
- Read only
- No
Record types
- A
- AAAA
- CNAME
- MX
- TXT
- NS
- SRV
- CAA
- HTTPS
Caveats
- Record sets that use GeoDNS or balancing filters, failover health checks, answer metadata or disabled answers are flagged and never changed by us.
- SRV records can't have an empty target, and PTR records only work in reverse-DNS zones.
- ALIAS records are written as CNAMEs, which Gcore flattens at the zone apex.
Troubleshooting
- The portal does not offer API token creation
- Reseller accounts cannot create permanent API tokens. Use an eligible customer account with Managed DNS access.
- Gcore rejects the credential
- Use the permanent token shown once after Create, not a one-hour Bearer token, and paste it without the APIKey prefix.
- A Users token can still change DNS
- This is documented Gcore behavior: account roles do not apply to Managed DNS, so no role produces a true preview-only DNS token.
- The token suddenly expires
- Check the token's Expiration setting or create a replacement with a date that covers the migration.