Skip to content
DNSmigrator
betaDNS betaDNS hostingSetup guide checked 2026-09-27

Infomaniak DNS

Infomaniak API token setup: create an Infomaniak token with `domain:read` and the DNS scopes needed for preview or apply.

On this page

Infomaniak API token permissions

Credential type
API token
Preview access
domain:read + dns:read
Apply access
domain:read + dns:read + dns:write
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

Add domain:write only if DNSMigrator should enable or disable DNSSEC. Infomaniak's endpoint metadata assigns domain:read to domain listing, dns:read to record reads, dns:write to zone and record writes, and domain:write to DNSSEC changes. Check access only tests domain:read.

DNSControl id

creds.json TYPE
{
  "TYPE": "INFOMANIAK"
}

Create credentials

Create an Infomaniak token with domain:read and the DNS scopes needed for preview or apply.

Access you'll grant

Preview

domain:read + dns:read

Apply

domain:read + dns:read + dns:write

Add domain:write only if DNSMigrator should enable or disable DNSSEC. Infomaniak's endpoint metadata assigns domain:read to domain listing, dns:read to record reads, dns:write to zone and record writes, and domain:write to DNSSEC changes. Check access only tests domain:read.

Before you start

  • An Infomaniak Manager account with access to the domains and DNS zones.
  • Your account password to confirm token creation.

Setup steps

0 of 6 done

  1. Open token management

    Sign in to Infomaniak Manager and open token management, then select Create a token.

    Open Infomaniak token management

  2. Select the DNS scopes

    Select domain:read and dns:read for a preview-only connection. Add dns:write if DNSMigrator will create zones or create, update, or delete records.

    Previewdomain:read dns:read
    Applydomain:read dns:read dns:write

  3. Add DNSSEC access only if needed

    Add domain:write only when DNSMigrator should enable or disable DNSSEC for an Infomaniak-registered domain. Record changes do not need this scope.

    DNSSECdomain:write

  4. Choose the token validity

    Select the product or application and choose a validity period. Infomaniak permits unlimited validity by default, but automatically deactivates a token after one year without use; choose a shorter expiry for a migration-only token.

  5. Confirm and copy the token

    Confirm creation with your account password, then copy the token immediately. Infomaniak does not display it again.

  6. Paste the token

    Paste the complete value into API token. DNSMigrator sends it as an OAuth2 Bearer token to api.infomaniak.com.

Troubleshooting

The zone list is empty or access is denied immediately

Create a replacement token with domain:read. DNSMigrator's connection check lists domains before it reads any DNS records.

Preview works but records cannot be read

Add dns:read. A successful connection check proves domain:read only; it does not call the record endpoint.

Preview works but apply returns 403

Add dns:write for zone and record changes. Add domain:write separately only when the operation changes DNSSEC.

An old token stopped working

Check its chosen expiry and last use. Infomaniak automatically deactivates a token after one year of inactivity; create a replacement if needed.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
API tokentokenRequiredThe secret shown once after Create a token. Use the token carrying domain:read and dns:read, plus dns:write for apply and optional domain:write for DNSSEC.

Capabilities

Create zones
Yes
List zones
Yes
DNSSEC
Managed through the API
Minimum TTL
60 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • DNAME
  • DS
  • SSHFP
  • TLSA
  • SMIMEA

Caveats

  • The API is limited to 60 requests per minute, so large zones apply slowly (one request per record value).
  • TTLs must be between 60 and 86400 seconds.
  • PTR records can be read but not created through the API.

Troubleshooting

The zone list is empty or access is denied immediately
Create a replacement token with domain:read. DNSMigrator's connection check lists domains before it reads any DNS records.
Preview works but records cannot be read
Add dns:read. A successful connection check proves domain:read only; it does not call the record endpoint.
Preview works but apply returns 403
Add dns:write for zone and record changes. Add domain:write separately only when the operation changes DNSSEC.
An old token stopped working
Check its chosen expiry and last use. Infomaniak automatically deactivates a token after one year of inactivity; create a replacement if needed.

Related links

Infomaniak DNS migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → InfomaniakRoute 53 → InfomaniakAzure DNS → InfomaniakCloud DNS → Infomaniak