Skip to content
DNSmigrator
betaDNS betaCDN and edgeSetup guide checked 2026-09-27

Vercel DNS

Vercel access token setup: create a team-scoped access token for the team that owns your domains, or a Full Account token for personal-account domains.

On this page

Vercel access token permissions

Credential type
Access token
Preview access
Scope → team → All Projects (read and write)
Apply access
Scope → team → All Projects (read and write)
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

Vercel scopes tokens by resource, not by read/write action. A project-scoped token cannot access the team-level Domains and DNS APIs used by this connection.

DNSControl id

creds.json TYPE
{
  "TYPE": "VERCEL"
}

Create credentials

Create a team-scoped access token for the team that owns your domains, or a Full Account token for personal-account domains.

Access you'll grant

Preview

Scope → team → All Projects (read and write)

Apply

Scope → team → All Projects (read and write)

Vercel scopes tokens by resource, not by read/write action. A project-scoped token cannot access the team-level Domains and DNS APIs used by this connection.

Before you start

  • A Vercel account or team membership that can manage the target domains.
  • Each domain must already be added to the Vercel account or team; this connection cannot add it.

Setup steps

0 of 7 done

  1. Open the Account Tokens page

    Switch the dashboard scope to your personal account, open its Settings area, then open the Account Tokens page.

    Open Vercel Account Tokens

  2. Name the token

    Enter a descriptive name so you can identify this DNSMigrator connection later.

  3. Choose the account or team scope

    Open Scope. For team-owned domains, select the team and then All Projects. For domains in your personal account, select Full Account. Do not select one project: DNS records are a team- or account-level resource.

    Team-owned domainsAll Projects
    Personal-account domainsFull Account

  4. Choose an expiration and create

    Choose an expiration that covers the migration and verification window, then select Create.

  5. Copy the token

    Copy the token immediately. Vercel shows it only once, and current personal access tokens begin with vcp_.

  6. Add the Team ID only when required

    Leave Team ID empty for a team-scoped token because Vercel infers the team from its scope. For a Full Account token targeting a team, open that team's Settings → General → Team ID and copy the value beginning with team_. Leave it empty for personal-account domains.

    Vercel: find your Team ID

  7. Paste the connection values

    Paste the token into Access token, add Team ID only for a Full Account token targeting a team, then check access.

Troubleshooting

The token cannot access the team

Use a token scoped to that team with All Projects selected. If you used Full Account, enter the matching team_ ID; do not enter the team name or slug.

The domain is not listed

Add the apex domain to the same Vercel account or team first. DNSMigrator reads existing Vercel domains but does not create them.

Vercel rejected the access token

The token is incomplete, expired, or revoked. Create a replacement and copy the complete one-time value.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
Access tokentokenRequiredThe one-time value shown after you create the token; current tokens begin with vcp_.
Team IDteamIdOptionalOptional immutable ID beginning with team_ from Team Settings → General → Team ID. Omit it for team-scoped tokens and personal-account domains.

Capabilities

Create zones
No
List zones
Yes
DNSSEC
Not available through this connection
Minimum TTL
60 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • ALIAS
  • CAA
  • CNAME
  • HTTPS
  • MX
  • NS
  • SRV
  • TXT

Caveats

  • Records Vercel adds for project domains (such as the apex ALIAS and CAA) are read with a comment and never changed by us. Edit them in the project's domain settings.
  • Domains must already be added to the Vercel account or team. We can't create them.
  • Vercel DNS doesn't support DNSSEC, and the minimum TTL is 60 seconds.

Troubleshooting

The token cannot access the team
Use a token scoped to that team with All Projects selected. If you used Full Account, enter the matching team_ ID; do not enter the team name or slug.
The domain is not listed
Add the apex domain to the same Vercel account or team first. DNSMigrator reads existing Vercel domains but does not create them.
Vercel rejected the access token
The token is incomplete, expired, or revoked. Create a replacement and copy the complete one-time value.

Related links

Vercel DNS migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → VercelRoute 53 → VercelAzure DNS → VercelCloud DNS → Vercel