Skip to content
DNSmigrator
stableDNS stableRegistrar betaRegistrarSetup guide checked 2026-09-27

GoDaddy DNS

GoDaddy API key setup: create the Production classic developer key and secret this connection currently uses to read and change GoDaddy DNS records and nameservers.

On this page

GoDaddy API key permissions

Credential type
Production API key and secret
Preview access
Account-wide classic developer key; GoDaddy provides no read-only scope
Apply access
The same account-wide key; DNS writes are not separately scoped
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

The registrar role uses the same key to change authoritative nameservers. GoDaddy's v1 API does not let this connection change DS records, so complete DNSSEC delegation changes in GoDaddy before cutover.

DNSControl id

This provider does not have a DNSControl id.

Create credentials

Create the Production classic developer key and secret this connection currently uses to read and change GoDaddy DNS records and nameservers.

Access you'll grant

Preview

Account-wide classic developer key; GoDaddy provides no read-only scope

Apply

The same account-wide key; DNS writes are not separately scoped

The registrar role uses the same key to change authoritative nameservers. GoDaddy's v1 API does not let this connection change DS records, so complete DNSSEC delegation changes in GoDaddy before cutover.

Before you start

  • A GoDaddy account with at least one active domain. GoDaddy's API terms also list an active Discount Domain Club – Domain Pro plan as an alternative qualification for Management and DNS API access.
  • The domain must be in this account and use GoDaddy's authoritative nameservers for DNS record changes.
  • A classic developer key, not a personal access token. GoDaddy recommends PATs for Domains v3 and has scheduled classic Domains credentials for retirement, but this connection currently calls Domains v1 with sso-key authentication.

Setup steps

0 of 5 done

  1. Confirm the account is eligible

    Make sure the account holds at least one active domain. GoDaddy currently grants the Domains API 20,000 calls per month at that level; higher thresholds affect availability checks, not basic domain management.

    Check GoDaddy API eligibility

  2. Open the API key page

    Sign in to GoDaddy and open API Keys. This connection needs the classic key pair on that page, not a token from Personal Access Token.

    Open GoDaddy API Keys

  3. Create a Production key

    Create a key and choose Production. OTE and Production use separate keys and separate hosts; an OTE key only works at api.ote-godaddy.com, while this form connects to api.godaddy.com.

  4. Copy the key pair

    Copy both Key and Secret immediately. GoDaddy shows the secret once; create a replacement pair if you leave without saving it.

  5. Paste the credentials

    Paste Key into API key and Secret into API secret, then check access.

Troubleshooting

`api-restricted`: GoDaddy returns 403

Confirm the account has at least one active domain or an eligible Domain Pro plan. If it is still refused, export the GoDaddy zone file and use that as the source.

GoDaddy rejected the API key and secret

The pair is incomplete, revoked, or from OTE. Create a new Production pair and copy both values from the same credential.

The domain list is empty

The connection lists domains owned by the authenticated account. Check that you created the key while signed in to the account that owns the domain.

GoDaddy will not change the nameservers

Remove a blocking domain lock and wait for any pending domain operation to finish. DS records must be removed or replaced in GoDaddy's DNSSEC controls, not through this connection.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
API keyapiKeyRequiredThe Key from the Production classic developer credential at developer.godaddy.com/keys.
API secretapiSecretRequiredThe matching Production Secret, shown once when the classic developer key is created.

Capabilities

Create zones
No
List zones
Yes
DNSSEC
Managed in the provider console
Minimum TTL
600 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA

Caveats

  • DS records can't be changed through GoDaddy's v1 API, so DNSSEC is handled in their dashboard.
  • GoDaddy's DNS API is limited to qualifying accounts. If yours isn't one, export the zone file and we'll use that.
  • The minimum TTL is 600 seconds.
  • Domain forwarding is a GoDaddy web feature, not a DNS record, and isn't migrated.

Troubleshooting

`api-restricted`: GoDaddy returns 403
Confirm the account has at least one active domain or an eligible Domain Pro plan. If it is still refused, export the GoDaddy zone file and use that as the source.
GoDaddy rejected the API key and secret
The pair is incomplete, revoked, or from OTE. Create a new Production pair and copy both values from the same credential.
The domain list is empty
The connection lists domains owned by the authenticated account. Check that you created the key while signed in to the account that owns the domain.
GoDaddy will not change the nameservers
Remove a blocking domain lock and wait for any pending domain operation to finish. DS records must be removed or replaced in GoDaddy's DNSSEC controls, not through this connection.

Related links

GoDaddy DNS migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → GoDaddyRoute 53 → GoDaddyAzure DNS → GoDaddyCloud DNS → GoDaddy