Skip to content
DNSmigrator
betaDNS betaRegistrar betaRegistrarSetup guide checked 2026-09-27

Openprovider

Openprovider API credentials setup: create a dedicated Openprovider contact, enable API access for it, and restrict its API sign-ins to DNSMigrator's static egress IP.

On this page

Openprovider API credentials permissions

Credential type
API-enabled contact username and password
Preview access
API access enabled for the contact; Openprovider has no read-only API credential
Apply access
The same contact login; API access cannot be reduced to DNS-only
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

The registrar role uses this login to change domain nameservers and DNSSEC keys. Use a dedicated contact and a per-user API IP allow-list, then disable its API access when it is no longer needed.

DNSControl id

creds.json TYPE
{
  "TYPE": "OPENPROVIDER"
}

Create credentials

Create a dedicated Openprovider contact, enable API access for it, and restrict its API sign-ins to DNSMigrator's static egress IP.

Access you'll grant

Preview

API access enabled for the contact; Openprovider has no read-only API credential

Apply

The same contact login; API access cannot be reduced to DNS-only

The registrar role uses this login to change domain nameservers and DNSSEC keys. Use a dedicated contact and a per-user API IP allow-list, then disable its API access when it is no longer needed.

Before you start

  • An active Openprovider reseller account.
  • Permission to add or edit contact persons and their API access settings.
  • Any registry contracts required for the domains you manage must already be signed under Account → Contracts.

Setup steps

0 of 6 done

  1. Open Contact persons

    Sign in to the Reseller Control Panel and go to Account overview → Contact persons.

    Open Openprovider account contacts

  2. Add a dedicated contact

    Select Add contact person and create a username and password used only by DNSMigrator. A separate contact is easier to revoke than sharing a person's control-panel login.

  3. Enable API access

    Open the contact's API tab and select Enable API access. API access is off by default and must be enabled for this contact.

  4. Allow-list DNSMigrator for API access

    In the contact's IP restrictions, choose the API access-level whitelist and add our egress IP. Openprovider applies IP white- and blacklists per user and separately for API or control-panel access.

    API whitelist IPour egress IP

  5. Paste the contact login

    Enter the dedicated contact's values in Username and Password, then check access.

  6. Use a separate Sandbox account for tests

    Create a separate account at cp.sandbox.openprovider.nl, enable API access for its contact, and turn on Use the sandbox API. Production credentials do not carry over; the Sandbox API is api.sandbox.openprovider.nl/v1beta.

    Create an Openprovider Sandbox account

Troubleshooting

`api-restricted`: API access is disabled

Open the contact's API tab and select Enable API access, then reconnect.

`ip-not-allowed`: Openprovider says “Access Denied”

Add our egress IP to this contact's API whitelist and remove any conflicting API blacklist entry.

Openprovider rejected the username or password

Use the contact's username and plain password. REST login does not accept the legacy XML API password hash.

Sandbox login fails

Create a new Sandbox account and enable API access there. Old CTE and Production credentials do not work in the current Sandbox.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
UsernameusernameRequiredThe username of the dedicated contact whose API access is enabled.
PasswordpasswordRequiredThat contact's password. The adapter exchanges it for a short-lived bearer token.
Use the sandbox APIsandboxOptionalTurn on only for a separate cp.sandbox.openprovider.nl account and its credentials.

Capabilities

Create zones
Yes
List zones
Yes
DNSSEC
Managed in the provider console
Minimum TTL
900 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • SRV
  • CAA
  • TLSA
  • SSHFP

Caveats

  • Openprovider only accepts TTLs of 900, 3600, 10800, 21600, 43200 and 86400 seconds; other TTLs are rounded up to the next accepted value.
  • Apex NS and SOA records are managed by Openprovider. NS records can't be added for subdomains and a CNAME can't sit at the zone apex (no ALIAS/ANAME).
  • Null MX records (target ".") aren't supported. Legacy SPF-type records can be read and removed but not created; use TXT.
  • Sectigo Premium DNS zones aren't listed or changed through this connection.
  • Zones on Openprovider nameservers are signed automatically. For domains on other nameservers, Openprovider registers DNSSEC from the DNSKEY public key, not the DS digest.
  • Identical API calls are limited to 300 per 5 minutes and failed logins to 100 per hour; going over can block the contact's API access until it's unblocked in the control panel.

Troubleshooting

`api-restricted`: API access is disabled
Open the contact's **API** tab and select **Enable API access**, then reconnect.
`ip-not-allowed`: Openprovider says “Access Denied”
Add {egressIp} to this contact's API whitelist and remove any conflicting API blacklist entry.
Openprovider rejected the username or password
Use the contact's username and plain password. REST login does not accept the legacy XML API password hash.
Sandbox login fails
Create a new Sandbox account and enable API access there. Old CTE and Production credentials do not work in the current Sandbox.

Related links

Openprovider migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → OpenproviderRoute 53 → OpenproviderAzure DNS → OpenproviderCloud DNS → Openprovider