Skip to content
DNSmigrator
betaDNS betaRegistrarSetup guide checked 2026-09-27

TransIP

TransIP API token setup: enable the TransIP API and use a whitelisted key pair for ongoing access, or a short-lived access token for a one-off connection.

On this page

TransIP API token permissions

Credential type
Username and API private key, or access token
Preview access
Read-only access token, or a key pair that mints a short-lived read/write token
Apply access
Read/write access token, or the recommended key pair
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

DNSMigrator currently registers TransIP as a DNS host only, so this connection changes DNS entries but does not automate registrar nameserver or DNSSEC changes.

DNSControl id

creds.json TYPE
{
  "TYPE": "TRANSIP"
}

Create credentials

Enable the TransIP API and use a whitelisted key pair for ongoing access, or a short-lived access token for a one-off connection.

Access you'll grant

Preview

Read-only access token, or a key pair that mints a short-lived read/write token

Apply

Read/write access token, or the recommended key pair

DNSMigrator currently registers TransIP as a DNS host only, so this connection changes DNS entries but does not automate registrar nameserver or DNSSEC changes.

Before you start

  • A TransIP account containing the domains whose DNS you want to manage.
  • The account API Status set to On.
  • For the recommended key-pair flow, permission to add our egress IP to the account's API whitelist.

Setup steps

0 of 7 done

  1. Open the API settings

    In the TransIP control panel, select the profile icon → My account → API.

    Open TransIP API settings

  2. Enable the API

    Change the slider beside Status to On.

  3. Allow-list DNSMigrator

    Under IP Whitelisting, enter our egress IP in IP address and select Add IP address. TransIP accepts IPv4, IPv6, and CIDR ranges.

    Whitelisted IPour egress IP

  4. Create a key pair

    Under Key Pairs, add a recognizable Label, leave Whitelisted IP enabled, and create the pair. A whitelist entry can be shared by all key pairs that use whitelisting.

  5. Copy the private key

    Copy the complete private key from Key Pair successfully added, including its BEGIN and END lines. TransIP shows it once.

  6. Paste the key-pair fields

    Enter the account login in TransIP username, paste the full PEM block into API private key, and turn on Key only accepts whitelisted IPs because Whitelisted IP was enabled when the pair was created.

  7. Use an access token only when it fits

    As an alternative, create a token under Access Tokens and paste it into Access token (instead of a key pair). Turn on Read-only for a preview-only token; leave it off to apply. Manually created tokens expire after at most one month.

Troubleshooting

`ip-not-allowed`: the key only accepts whitelisted IPs

Add our egress IP under IP Whitelisting and ensure Key only accepts whitelisted IPs matches the key pair's Whitelisted IP setting.

`api-restricted`: API Status is off

Open My account → API and set Status to On.

The access token expired or cannot apply

Create a new token with Read-only off, or switch to a key pair so DNSMigrator can mint fresh 30-minute tokens.

The private key cannot be read

Paste the full PEM block exactly as TransIP displayed it, including every line break and both boundary lines.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
TransIP usernameloginOptionalThe TransIP account login used with the key pair. It is not required when an access token is supplied.
API private keyprivateKeyOptionalThe complete one-time PEM private key, including the BEGIN and END lines.
Key only accepts whitelisted IPswhitelistedOnlyOptionalTurn on when the key pair was created with TransIP's Whitelisted IP option; DNSMigrator then requests non-global tokens.
Access token (instead of a key pair)accessTokenOptionalA temporary JWT from Access Tokens. Use instead of the username and private key, not in addition to them.

Capabilities

Create zones
No
List zones
Yes
DNSSEC
Managed in the provider console
Minimum TTL
60 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • ALIAS
  • NAPTR
  • SSHFP
  • TLSA

Caveats

  • Every change replaces the domain's full DNS entry list in one request; entries outside the plan are sent back unchanged.
  • The API allows 1000 requests per 15 minutes per account, and access tokens expire after at most one month.
  • TXT values with double quotes, backslashes, backticks or trailing spaces are rejected or altered by TransIP.

Troubleshooting

`ip-not-allowed`: the key only accepts whitelisted IPs
Add {egressIp} under **IP Whitelisting** and ensure **Key only accepts whitelisted IPs** matches the key pair's **Whitelisted IP** setting.
`api-restricted`: API Status is off
Open **My account** → **API** and set **Status** to **On**.
The access token expired or cannot apply
Create a new token with **Read-only** off, or switch to a key pair so DNSMigrator can mint fresh 30-minute tokens.
The private key cannot be read
Paste the full PEM block exactly as TransIP displayed it, including every line break and both boundary lines.

Related links

TransIP migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → TransIPRoute 53 → TransIPAzure DNS → TransIPCloud DNS → TransIP