Skip to content
DNSmigrator
betaDNS betaCloud platformSetup guide checked 2026-09-27

Hetzner DNS

Hetzner API token setup: generate a project-scoped Hetzner Cloud API token for the project that contains your DNS zones.

On this page

Hetzner API token permissions

Credential type
API token
Preview access
**Read**
Apply access
**Read & Write**
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

Tokens are project-scoped. DNSMigrator can write primary zones, but Hetzner secondary zones are read-only.

DNSControl id

creds.json TYPE
{
  "TYPE": "HETZNER_V2"
}

Create credentials

Generate a project-scoped Hetzner Cloud API token for the project that contains your DNS zones.

Access you'll grant

Preview

Read

Apply

Read & Write

Tokens are project-scoped. DNSMigrator can write primary zones, but Hetzner secondary zones are read-only.

Before you start

  • A Hetzner Console account and access to the project that contains the DNS zones.
  • Current zones in Hetzner Console; legacy DNS Console API tokens do not work with the Cloud API.

Setup steps

0 of 5 done

  1. Open the correct project

    Sign in to Hetzner Console and select the project that contains the DNS zones you want to migrate or manage.

    Open Hetzner Console

  2. Open API tokens

    Inside the project, select Security → API tokens → Generate API token.

  3. Choose the permission

    Enter a recognizable description. Select Read for a source or preview-only connection, or Read & Write for a destination connection that DNSMigrator will change.

    PreviewRead
    ApplyRead & Write

  4. Generate and copy the token

    Select Generate API token and copy the secret immediately. Hetzner displays it only once.

  5. Paste the token

    Paste the complete secret into Hetzner Cloud API token here without a Bearer prefix.

Troubleshooting

Hetzner rejects the token

Create the token in Hetzner Console. Tokens from the retired DNS Console use a different API and are not accepted.

Expected zones are missing

The token only sees its project. Generate it from the project that owns the migrated DNS zones.

Preview works but apply is forbidden

Create a Read & Write token; a Read token permits GET requests only.

A secondary zone cannot be changed

Hetzner secondary zones are read-only. Use or create a primary zone as the migration destination.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
Hetzner Cloud API tokenapiTokenRequiredThe one-time secret generated under the selected project's Security → API tokens page.

Capabilities

Create zones
Yes
List zones
Yes
DNSSEC
Not available through this connection
Minimum TTL
60 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • PTR
  • DS
  • HTTPS
  • SVCB
  • TLSA
  • RP

Caveats

  • Uses the Hetzner Console (Cloud API) DNS. The old DNS Console at dns.hetzner.com and its API were shut down in May 2026.
  • The Cloud API has no DNSSEC signing, so turn DNSSEC off at the registrar before switching nameservers.
  • Only registrable domains can be zones. Subdomains such as dev.example.com can't be their own zone.

Troubleshooting

Hetzner rejects the token
Create the token in Hetzner Console. Tokens from the retired DNS Console use a different API and are not accepted.
Expected zones are missing
The token only sees its project. Generate it from the project that owns the migrated DNS zones.
Preview works but apply is forbidden
Create a Read & Write token; a Read token permits GET requests only.
A secondary zone cannot be changed
Hetzner secondary zones are read-only. Use or create a primary zone as the migration destination.

Related links

Hetzner DNS migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → HetznerRoute 53 → HetznerAzure DNS → HetznerCloud DNS → Hetzner