Skip to content
DNSmigrator
betaDNS betaRegistrar betaRegistrarSetup guide checked 2026-09-27

Porkbun

Porkbun API key setup: create a dedicated Porkbun key pair, restrict it to DNSMigrator and your domains, and opt those domains in to API access.

On this page

Porkbun API key permissions

Credential type
API key and secret API key
Preview access
Dedicated API key pair; Porkbun has no read-only key mode
Apply access
The same API key pair; restrict it by source IP and target domain
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

The registrar role uses this pair to change nameservers and add or remove DNSSEC records at the registry. The per-domain API Access setting and the key's domain allow-list apply to those calls too.

DNSControl id

creds.json TYPE
{
  "TYPE": "PORKBUN"
}

Create credentials

Create a dedicated Porkbun key pair, restrict it to DNSMigrator and your domains, and opt those domains in to API access.

Access you'll grant

Preview

Dedicated API key pair; Porkbun has no read-only key mode

Apply

The same API key pair; restrict it by source IP and target domain

The registrar role uses this pair to change nameservers and add or remove DNSSEC records at the registry. The per-domain API Access setting and the key's domain allow-list apply to those calls too.

Before you start

  • A Porkbun account containing the domains you want to manage.
  • API Access enabled for each domain, or Opt In All Domains enabled on the API settings page.
  • Porkbun has no read-only key mode; use a dedicated key with source-IP and domain restrictions.

Setup steps

0 of 6 done

  1. Open API Access

    Sign in, select ACCOUNT → API Access, and create a key specifically for DNSMigrator.

    Open Porkbun API Access

  2. Create the key pair

    Enter a recognizable key name and select Create API Key.

  3. Copy both keys

    Copy the API Key (pk1_…) and Secret Key (sk1_…) from the success message. The secret is shown once; if it is lost, delete this key and create another.

  4. Restrict the key

    Select the gear icon beside the key. Limit source IPs to our egress IP and target domains to only the domains you are moving. Porkbun accepts bare IPv4 or IPv6 addresses and CIDR ranges, one per line.

    Allowed source IPour egress IP

  5. Enable each domain

    Go to ACCOUNT → Domain Management, select Details beside a domain, and turn on API Access. Repeat for each domain, or use Opt In All Domains on the API settings page if that broader setting is intentional.

  6. Paste the key pair

    Paste the public value into API key and the one-time secret into Secret API key, then check access.

Troubleshooting

Porkbun rejected the API key pair

Make sure the pk1_ and sk1_ values came from the same key. Delete and recreate the pair if the secret was not saved completely.

`api-restricted`: API Access is off for the domain

Open Domain Management → Details and enable API Access, or intentionally enable Opt In All Domains.

`ip-not-allowed`: the source IP is outside the key allow-list

Open the key's gear settings and add our egress IP to its source-IP allow-list.

The domain is not allowed

Add the exact registered domain to the key's target-domain allow-list. A listed domain does not implicitly include another registered domain.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
API keyapiKeyRequiredThe public key beginning with pk1_, shown when the API key is created.
Secret API keysecretApiKeyRequiredThe matching secret beginning with sk1_, shown only once at creation.

Capabilities

Create zones
No
List zones
Yes
DNSSEC
Not available through this connection
Minimum TTL
600 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • ALIAS
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • TLSA
  • SSHFP
  • HTTPS
  • SVCB

Caveats

  • API Access must be turned on per domain, and only domains registered at Porkbun can be managed.
  • The minimum TTL is 600 seconds and a zone holds at most 2,500 records.
  • URL forwarding is not migrated; the ALIAS/CNAME records Porkbun creates for it are copied as plain records.

Troubleshooting

Porkbun rejected the API key pair
Make sure the `pk1_` and `sk1_` values came from the same key. Delete and recreate the pair if the secret was not saved completely.
`api-restricted`: API Access is off for the domain
Open **Domain Management** → **Details** and enable **API Access**, or intentionally enable **Opt In All Domains**.
`ip-not-allowed`: the source IP is outside the key allow-list
Open the key's gear settings and add {egressIp} to its source-IP allow-list.
The domain is not allowed
Add the exact registered domain to the key's target-domain allow-list. A listed domain does not implicitly include another registered domain.

Related links

Porkbun migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → PorkbunRoute 53 → PorkbunAzure DNS → PorkbunCloud DNS → Porkbun