Skip to content
DNSmigrator
betaDNS betaRegistrar betaRegistrarSetup guide checked 2026-09-27

OVHcloud DNS

OVHcloud signing key setup: create an OVHcloud application credential in the account's API region and grant only the DNS and registrar paths this connection calls.

On this page

OVHcloud signing key permissions

Credential type
Application key, application secret, and consumer key
Preview access
GET `/domain/zone` and GET `/domain/zone/*`
Apply access
GET, POST, PUT, and DELETE on `/domain/zone/*`
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

For registrar cutover, also grant GET `/domain`, GET and PUT `/domain/*`, POST `/domain/*/nameServers/update`, and POST `/domain/*/dsRecord`. These additional rules let the connection read domains, change nameservers, and replace registry DNSSEC keys.

DNSControl id

creds.json TYPE
{
  "TYPE": "OVH"
}

Create credentials

Create an OVHcloud application credential in the account's API region and grant only the DNS and registrar paths this connection calls.

Access you'll grant

Preview

GET /domain/zone and GET /domain/zone/*

Apply

GET, POST, PUT, and DELETE on /domain/zone/*

For registrar cutover, also grant GET /domain, GET and PUT /domain/*, POST /domain/*/nameServers/update, and POST /domain/*/dsRecord. These additional rules let the connection read domains, change nameservers, and replace registry DNSSEC keys.

Before you start

  • An active OVHcloud account with the DNS zones or registered domains you want to manage.
  • The correct account region: OVHcloud Europe (ovh-eu), North America/Canada (ovh-ca), or US (ovh-us).
  • Permission to create an application credential and authorize its consumer key.

Setup steps

0 of 6 done

  1. Choose the account region

    Use the token page that matches the account: Europe, North America/Canada, or US. Select the same value later under API region.

    Open the Europe token page

  2. Describe the application

    Sign in with the OVHcloud customer ID and password. Enter an Application name, optional Application description, and a Validity period that covers the migration.

  3. Add the DNS access rules

    In Rights, add both read paths for a preview. To apply records and publish the zone, also add POST, PUT, and DELETE for the wildcard path.

    List zonesGET /domain/zone
    Read zonesGET /domain/zone/*
    Create and refreshPOST /domain/zone/*
    Update recordsPUT /domain/zone/*
    Delete recordsDELETE /domain/zone/*

  4. Add registrar rules for automated cutover

    If this connection should also change nameservers or registry DNSSEC data, add the domain rules below. Leave them out for a DNS-host-only connection.

    List domainsGET /domain
    Read domains and tasksGET /domain/*
    Switch nameserver typePUT /domain/*
    Change nameserversPOST /domain/*/nameServers/update
    Replace DNSSEC keysPOST /domain/*/dsRecord

  5. Create and copy all three keys

    Select Create keys, then copy Application key (AK), Application secret (AS), and Consumer key (CK). The AS and CK are secrets.

  6. Paste the regional credential

    Choose API region, then paste the AK into Application key, the AS into Application secret, and the CK into Consumer key.

Troubleshooting

The consumer key is not validated

Create the credential while signed in to the target account and finish its authorization. Recreate it if the CK is still pending or expired.

OVHcloud rejected the signature

Choose the region where the keys were created and paste the AK, AS, and CK from the same credential. Keys from another endpoint do not authenticate here.

Access is read-only or forbidden

Compare Rights with the copyable rules above. A preview needs both GET rules; applying needs POST, PUT, and DELETE on /domain/zone/*.

The DNS zone is missing

Order or create the DNS zone in OVHcloud first. This connection does not order a missing zone.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
API regionendpointOptionalThe region where the account lives: ovh-eu, ovh-ca, or ovh-us. Europe is the form default.
Application keyapplicationKeyRequiredThe Application key (AK) returned by the matching regional token page.
Application secretapplicationSecretRequiredThe secret Application secret (AS) returned with the AK.
Consumer keyconsumerKeyRequiredThe Consumer key (CK) authorized for this account and the listed access rules.

Capabilities

Create zones
No
List zones
Yes
DNSSEC
Managed through the API
Minimum TTL
60 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • PTR
  • DNAME
  • HTTPS
  • SVCB
  • TLSA
  • SSHFP
  • NAPTR
  • LOC
  • RP

Caveats

  • OVHcloud reads each record with a separate API call, so large zones take a while to load.
  • Changes are published when the zone is refreshed, which we trigger after applying; it can take a few minutes.
  • TXT values can't contain double quotes or backslashes, and ALIAS records aren't supported.

Troubleshooting

The consumer key is not validated
Create the credential while signed in to the target account and finish its authorization. Recreate it if the CK is still pending or expired.
OVHcloud rejected the signature
Choose the region where the keys were created and paste the AK, AS, and CK from the same credential. Keys from another endpoint do not authenticate here.
Access is read-only or forbidden
Compare **Rights** with the copyable rules above. A preview needs both GET rules; applying needs POST, PUT, and DELETE on `/domain/zone/*`.
The DNS zone is missing
Order or create the DNS zone in OVHcloud first. This connection does not order a missing zone.

Related links

OVHcloud DNS migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → OVHcloudRoute 53 → OVHcloudAzure DNS → OVHcloudCloud DNS → OVHcloud