Skip to content
DNSmigrator
betaRegistrar betaRegistrarSetup guide checked 2026-09-27

OpenSRS

OpenSRS API key setup: use an OpenSRS reseller API key, allow the DNSMigrator egress IP for live access, and select Live or the separate Horizon test environment.

On this page

OpenSRS API key permissions

Credential type
Reseller username and API key
Preview access
GET_DOMAINS_BY_EXPIREDATE and GET for nameservers and DNSSEC
Apply access
ADVANCED_UPDATE_NAMESERVERS and SET_DNSSEC_INFO
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

The API key is account-level rather than separately scoped. Check access only lists one domain and does not test nameserver or DNSSEC updates.

DNSControl id

creds.json TYPE
{
  "TYPE": "OPENSRS"
}

Create credentials

Use an OpenSRS reseller API key, allow the DNSMigrator egress IP for live access, and select Live or the separate Horizon test environment.

Access you'll grant

Preview

GET_DOMAINS_BY_EXPIREDATE and GET for nameservers and DNSSEC

Apply

ADVANCED_UPDATE_NAMESERVERS and SET_DNSSEC_INFO

The API key is account-level rather than separately scoped. Check access only lists one domain and does not test nameserver or DNSSEC updates.

Before you start

  • An OpenSRS reseller account; retail registrant accounts cannot use this API.
  • Primary reseller-user access to generate a key or edit API IP access rules.

Setup steps

0 of 6 done

  1. Open API settings

    Sign in to the Reseller Control Panel, select Account settings in the upper-right, then select API settings.

    Open OpenSRS Reseller Control Panel

  2. Use or generate the API key

    Copy the current key, or select Generate new API key. Generating a replacement immediately invalidates the old key, so update every existing integration that uses it.

  3. Add a live IP access rule

    Under IP access rules, select Edit. Enter our address in IP address, choose /32 under CIDR prefix, choose Allow under Type, then select Add. OpenSRS permits at most five rules and supports prefixes /25 through /32.

    IP addressour egress IP
    CIDR prefix/32
    TypeAllow

  4. Choose the environment

    Keep Use the OpenSRS test environment (Horizon) off for live domains. Horizon uses a separate test account/key and, unlike Live, does not require an authorized source IP.

  5. Copy the reseller username

    Use the primary OpenSRS reseller account identifier shown in the control panel, not a registrant profile username.

  6. Enter the OpenSRS values

    Paste the account identifier into Reseller username, the private key into API key, set the Horizon switch, and check access.

Troubleshooting

OpenSRS rejects authentication

Confirm the reseller username and key belong to the selected Live or Horizon account. A newly generated key makes the prior key invalid immediately.

Live API calls are not allowed from this IP

Add our egress IP/32 as an Allow rule under IP access rules. Also permit outbound TCP port 55443 in your own network if applicable.

The domain list is empty in Horizon

Horizon is a separate test environment and does not mirror live domains. Turn off the test switch for the production reseller account.

OpenSRS rejects a DS algorithm

Its SET_DNSSEC_INFO documentation allows algorithms 5, 6, 7, 8, 10, 253, and 254. Use a supported DS set or manage the record with OpenSRS support.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
Reseller usernameusernameRequiredThe OpenSRS reseller username sent in the X-Username API header.
API keyapiKeyRequiredThe private API key shown under Account settings → API settings. Replacing it invalidates the prior key immediately.
Use the OpenSRS test environment (Horizon)sandboxOptionalOff uses rr-n1-tor.opensrs.net:55443 (Live). On uses horizon.opensrs.net:55443 with a separate Horizon test account/key.

Caveats

  • Reseller accounts only.
  • DS records are replaced as a whole set.
  • API calls must come from an allow-listed IP address.

Troubleshooting

OpenSRS rejects authentication
Confirm the reseller username and key belong to the selected Live or Horizon account. A newly generated key makes the prior key invalid immediately.
Live API calls are not allowed from this IP
Add {egressIp}/32 as an Allow rule under IP access rules. Also permit outbound TCP port 55443 in your own network if applicable.
The domain list is empty in Horizon
Horizon is a separate test environment and does not mirror live domains. Turn off the test switch for the production reseller account.
OpenSRS rejects a DS algorithm
Its SET_DNSSEC_INFO documentation allows algorithms 5, 6, 7, 8, 10, 253, and 254. Use a supported DS set or manage the record with OpenSRS support.

Related links

OpenSRS migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.