Skip to content
DNSmigrator
betaDNS betaCloud platformSetup guide checked 2026-09-27

Scaleway Domains and DNS

Scaleway signing key setup: create an IAM application, grant it a project-scoped Domains DNS permission set, and generate a secret key.

On this page

Scaleway signing key permissions

Credential type
Secret key
Preview access
`DomainsDNSReadOnly`
Apply access
`DomainsDNSFullAccess`
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

Scope the policy to the project that contains the DNS zones. DNSMigrator needs only the generated secret key, not its paired access key.

DNSControl id

creds.json TYPE
{
  "TYPE": "SCALEWAY"
}

Create credentials

Create an IAM application, grant it a project-scoped Domains DNS permission set, and generate a secret key.

Access you'll grant

Preview

DomainsDNSReadOnly

Apply

DomainsDNSFullAccess

Scope the policy to the project that contains the DNS zones. DNSMigrator needs only the generated secret key, not its paired access key.

Before you start

  • A Scaleway account with Owner status or IAM permissions to manage applications, policies and API keys.
  • An existing Scaleway DNS zone; this connector can update records but cannot create zones.

Setup steps

0 of 6 done

  1. Create an IAM application

    Open IAM & API keys → Applications → Create application. Enter a name such as DNSMigrator, then create the application to use as the long-lived key's bearer.

    Create a Scaleway application

  2. Start a policy

    In the side menu, select IAM, open the Policies tab, and select Create policy. Enter a name and description, then select the new application as the principal.

  3. Add the DNS rule

    Under permission sets, select the preview or apply set below and select Next. Choose Specific projects, select the project holding the zones, select Next → Confirm rule, then Create policy.

    PreviewDomainsDNSReadOnly
    ApplyDomainsDNSFullAccess

  4. Generate an API key

    Open IAM & API keys → API keys → + Generate API key. Choose the application as bearer, add an optional description, select an expiration, and select Generate API key.

    Scaleway: create API keys

  5. Copy the secret key

    Scaleway shows an access key and a UUID secret key. Copy the secret key immediately because it is displayed only once; DNSMigrator does not use the access key.

  6. Enter the Scaleway values

    Paste the UUID into API secret key. Project ID is optional: enter the UUID of the same project selected in the policy to filter zone discovery, or leave it empty to use every project visible to the key.

Troubleshooting

The key is rejected

Check that you pasted the one-time UUID secret key, not the access key displayed beside it.

No zones are found

Confirm that the policy uses DomainsDNSReadOnly or DomainsDNSFullAccess and is scoped to the project that owns the zones. Remove an incorrect optional Project ID.

Preview works but apply is forbidden

Replace DomainsDNSReadOnly with DomainsDNSFullAccess in the application's policy and check access again.

DNSMigrator cannot create the destination zone

Create the DNS zone in Scaleway first. This connector supports record updates only after the zone exists.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
API secret keysecretKeyRequiredThe UUID secret shown once when the API key is generated. Do not paste the paired access key.
Project IDprojectIdOptionalOptional project UUID for the project containing the zones; leave empty to discover zones across all projects allowed by the policy.

Capabilities

Create zones
No
List zones
Yes
DNSSEC
Managed in the provider console
Minimum TTL
60 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • ALIAS
  • TLSA
  • SSHFP
  • NAPTR
  • DNAME
  • SVCB
  • HTTPS

Caveats

  • Zones must already exist in the Scaleway console. We can't create them.
  • Records that use GeoIP, weighted, HTTP-service or view routing are copied as their default value, flagged in a comment and never changed by us.
  • NS records below the apex need a TTL of at least 1800 seconds, so shorter TTLs are raised.

Troubleshooting

The key is rejected
Check that you pasted the one-time UUID secret key, not the access key displayed beside it.
No zones are found
Confirm that the policy uses DomainsDNSReadOnly or DomainsDNSFullAccess and is scoped to the project that owns the zones. Remove an incorrect optional Project ID.
Preview works but apply is forbidden
Replace DomainsDNSReadOnly with DomainsDNSFullAccess in the application's policy and check access again.
DNSMigrator cannot create the destination zone
Create the DNS zone in Scaleway first. This connector supports record updates only after the zone exists.

Related links

Scaleway Domains and DNS migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → ScalewayRoute 53 → ScalewayAzure DNS → ScalewayCloud DNS → Scaleway