Provider connections

Plug in what you already have.

DomainVigil monitors any domain without connecting anything. Connecting your registrar, DNS or server hands the AI the keys to fix things for you — transfer lock, DNS records, SPF and DKIM, certificate. Here are the 37 providers we can connect, and what each one unlocks.

37 providers · 27 with portfolio import

Registrars

Where the domain is bought and renewed: transfer lock, auto-renew, and often the DNS too.

OVHcloud
Registrar · DNS · Server
Portfolio import
Where to find the token
1. On the OVH page that opens, leave the name and description as they are.
2. Rights: tick GET, POST, PUT and DELETE, each on the “/*” path.
3. Validity: “Unlimited” — otherwise the connection stops working at expiry, without warning.
4. Validate: OVH shows three values (application key, secret, consumer key). Copy all three, they are shown once.
Open the token page at OVHcloud
Hostinger
Registrar · DNS
Portfolio import
Where to find the token
1. In hPanel, click your profile icon, then “Account Information”.
2. In the left menu, open “API”, then “Generate token”.
3. Give it a name and an expiry date — avoid a very distant one, but note it down: the connection stops that day.
4. Copy the token: it is no longer accessible once the menu is closed.
Open the token page at Hostinger
Gandi
Registrar · DNS
Portfolio import
Where to find the token
1. On admin.gandi.net, go to “Organizations”, then pick the organization that owns your domains.
2. Open the “Sharing” tab, then “Create a token”.
3. Name it, choose an expiry (7 days to one year — take the longest, otherwise the connection will drop), and tick the DOMAIN NAMES permission.
4. Create, then copy the token: it is shown only once.
Open the token page at Gandi
Infomaniak
Registrar · DNS
Portfolio import
Where to find the token
1. On the page that opens (profile → “Token management”), click “Create a token”.
2. Product: “Domain”. Validity: leave it “unlimited” — an expiry date would cut the connection without warning.
3. Infomaniak asks for your account password again to confirm.
4. Copy the token: it is not shown again, and it goes inactive after a year without use.
Open the token page at Infomaniak
GoDaddy
Registrar · DNS
Portfolio import
Where to find the token
1. On the GoDaddy page that opens, click “Create New API Key”.
2. Environment: “Production”. An “OTE” key only talks to the sandbox and will see none of your domains.
3. GoDaddy shows a Key and a Secret: copy both here.
Open the token page at GoDaddy
Porkbun
Registrar · DNS
Portfolio import
Where to find the token
1. On the Porkbun page that opens, create an API key: you get a key and a secret.
2. Then, in your domain list, switch on “API Access” for EACH domain to monitor — without it Porkbun rejects the key for that domain, and the error message does not say so.
3. Copy both values here.
Open the token page at Porkbun
Name.com
Registrar · DNS
Portfolio import
Where to find the token
1. On name.com, click the user icon at the top right, “Settings”, then “API Tokens” under Security.
2. If you use two-factor authentication, first switch on “Name.com API Access” in Account Settings → Security: without it the token is rejected.
3. “Create API Token”, accept the agreement, name the token, then “Generate new token”.
4. Take the one from the PRODUCTION section (not Development), and enter your name.com username here — not your email address.
Open the token page at Name.com
DNSimple
Registrar · DNS
Portfolio import
Where to find the token
1. On dnsimple.com, open your account page, then the “API & Access” tab in the left column.
2. Click “Add”: prefer an ACCOUNT token to a user token — that is what DNSimple recommends.
3. Name it. On the Teams plan or higher, grant at least read access on Domains and Zones; on Solo, the token has full permissions by default.
4. “Generate token”, then copy it: it is shown only once.
Open the token page at DNSimple
NameSilo
Registrar · DNS
Portfolio import
Where to find the token
1. On the API Manager page that opens, request a new API key and submit the form.
2. Leave the IP address fields empty: a restriction would stop our servers from using it.
3. Copy the key straight away: NameSilo never shows it again — if lost, you have to generate a new one.
Open the token page at NameSilo
Dynadot
Registrar · DNS
Portfolio import
Where to find the token
1. On dynadot.com, left menu “Tools” → “API”, then unlock the account with the link shown on the page.
2. Take the PRODUCTION key — not the Sandbox one, which sees none of your domains.
3. IP addresses: leave empty, otherwise our servers are refused. Dynadot takes up to ten minutes to apply a change.
4. Copy the key here.
Open the token page at Dynadot
Namecheap
Registrar · DNS
Portfolio import
Where to find the token
1. On the Namecheap page that opens (Profile → Tools → API Access), switch the API on, then generate the key — it is shown only once.
2. ⚠️ Under “Whitelisted IPs”, add our address: 138.199.145.149. Namecheap only accepts listed addresses; without this line the key is valid but our servers are refused.
3. Enter your Namecheap username here (the one you sign in with), not your email address.
4. Namecheap opens the API only to accounts with at least 20 domains, $50 of balance or $50 spent in the year: that is their condition, not ours.
Open the token page at Namecheap
Amazon Route 53 Domains
Registrar
Portfolio import
Where to find the token
1. In the IAM console that opens, click your name at the top right, then “Security credentials”.
2. “Access keys” section → “Create access key”; use case: “Other”, then “Next”, then “Create access key”. Copy both values — the secret is visible only at that moment.
3. The IAM user must be allowed the route53domains:ListDomains and route53domains:GetDomainDetail actions. Without them the key is valid but AWS refuses to list your domains.
4. This service is the AWS REGISTRAR, different from Route 53 (DNS hosting): if your domains are bought elsewhere, the other entry is the one you need.
Open the token page at Amazon Route 53 Domains

DNS hosts

The DNS zone: the tier that unlocks the most repairs — records, SPF, DKIM, DMARC, certificate.

Cloudflare
DNS
Portfolio import
Where to find the token
1. On the page that opens, choose “Create Custom Token” (the first block) — none of the templates fits.
2. Permissions, three rows to add: Zone · DNS · Edit — Zone · Zone Settings · Edit — Zone · Zone · Read.
3. Zone Resources: “Include” · “All zones”, or only the domains you entrust to us.
4. Continue, then “Create Token”, and copy it: Cloudflare shows it only once.
Open the token page at Cloudflare
Hetzner DNS
DNS
Portfolio import
Where to find the token
1. Hetzner DNS now lives in the Hetzner Console (console.hetzner.com), with the same token as Hetzner Cloud: enter the project holding your DNS zones.
2. “Security” menu → “API tokens” tab → “Generate API token”, with “Read & Write” rights.
3. Copy the token: it is shown only once.
4. A zone still on the old dns.hetzner.com console must be migrated there first: old tokens stopped working in November 2025.
Open the token page at Hetzner DNS
deSEC
DNS
Portfolio import
Where to find the token
1. On desec.io, sign in and open the “Token Management” tab.
2. Click the “+” button to create a token and give it a name.
3. Leave the advanced settings as they are: IP restrictions would stop our servers from using it.
4. Copy the token: it is not shown again.
Open the token page at deSEC
Bunny.net
DNS
Portfolio import
Where to find the token
1. The page that opens shows the account API key directly: there is only one, and it stays visible.
2. Copy it here.
3. On a sub-account the key does not appear: ask the main account holder for it.
Open the token page at Bunny.net
IONOS
DNS
Portfolio import
Where to find the token
1. On the IONOS page that opens, click “Create new key” and give it a name.
2. IONOS shows TWO parts: a public prefix and a secret.
3. Paste both here joined by a dot, as prefix.secret — that is the complete key we expect.
4. Write them down straight away: the secret cannot be viewed after you close the page.
Open the token page at IONOS
Google Cloud DNS
DNS
Portfolio import
Where to find the token
1. On the page that opens, pick the project holding your DNS zones, then “Create service account” and give it a name.
2. Once created, open it, “Keys” tab → “Add key” → “Create new key” → JSON format. A file downloads.
3. In “IAM & Admin” → “IAM”, grant that service account the “DNS Reader” role (roles/dns.reader) on the project.
4. Open the downloaded file in a text editor and paste its WHOLE CONTENT here, from the first brace to the last. We read the project, the account address and the key from it.
Open the token page at Google Cloud DNS
Azure DNS
DNS
Portfolio import
Where to find the token
1. On the page that opens (Microsoft Entra → App registrations), click “New registration”, give it a name (for example “DomainVigil”), and confirm.
2. On the application page, note the “Application (client) ID” and the “Directory (tenant) ID”: those are the first two values to enter here.
3. “Certificates & secrets” menu → “New client secret” → create it, then copy the “Value” column (not “Secret ID”): it is readable only at that moment.
4. Last step, the one most often missed: on your SUBSCRIPTION (Access control IAM → Add role assignment), give this application the “Reader” role — or “DNS Zone Contributor” if you want us to repair your records. Without a role the credentials are valid but Azure shows nothing.
Open the token page at Azure DNS
ClouDNS
DNS
Where to find the token
1. On ClouDNS, open the “API & Resellers” section of your panel, then “Add new user” to create an API user.
2. ClouDNS then shows a numeric id (auth-id) and a password: those are the two values we expect here.
3. Leave the IP address restriction empty: a restriction would stop our servers from using it.
4. The API user is separate from your account: disabling it cuts the connection without touching your usual access.
Open the token page at ClouDNS
Vercel
DNS
Portfolio import
Where to find the token
1. On the page that opens (Account Settings → Tokens), click “Create”.
2. Name the token and pick its scope: your personal account, or the Team that holds your domains.
3. “Create Token”, then copy it: Vercel does not show it again.
Open the token page at Vercel
Netlify
DNS
Portfolio import
Where to find the token
1. On the page that opens (User settings → Applications → Personal access tokens), click “New access token”.
2. Name it and pick the furthest expiry: when it passes, the connection stops without warning.
3. “Generate token”, then copy it: it is no longer visible once you leave the page.
4. Resetting your Netlify password invalidates every token: you would have to create a new one.
Open the token page at Netlify
Amazon Route 53
DNS
Portfolio import
Where to find the token
1. In the IAM console that opens, click your name at the top right, then “Security credentials”.
2. “Access keys” section → “Create access key”; use case: “Other”, then “Next”, then “Create access key”.
3. AWS shows an Access key ID and a Secret access key: copy both — the secret is visible only at that moment.
4. The IAM user must carry the AmazonRoute53ReadOnlyAccess policy (or more): without it the key is valid but Route 53 refuses to list your zones.
Open the token page at Amazon Route 53

Servers and clouds

The machine serving the site: reverse DNS, availability, and the DNS when the cloud hosts it too.

Hetzner Cloud
Server
Where to find the token
1. In the Hetzner Cloud console, enter the project holding your servers.
2. “Security” menu → “API tokens” tab → “Generate API token”.
3. Rights: “Read & Write”. Read-only is enough to see, not to fix.
4. Copy the token: it is shown only once.
Open the token page at Hetzner Cloud
Scaleway
Server · DNS
Portfolio import
Where to find the token
1. In the Scaleway console, open the top-right menu, then “IAM & API keys” → “API keys” tab.
2. “Generate API key”, bearer: yourself, and leave the longest expiry available.
3. Scaleway shows an access key AND a secret key. Paste the SECRET key here — that is what authenticates; the access key is only an identifier.
4. The secret key is shown only once.
Open the token page at Scaleway
DigitalOcean
Server · DNS
Portfolio import
Where to find the token
1. On the DigitalOcean page that opens (Account → API → Tokens tab), click “Generate New Token”.
2. Name the token and choose the longest expiry: once it passes, the token stops working and disappears from the account.
3. Scopes: grant READ and WRITE on Domains. Without write we can see but not fix, and scopes cannot be changed after creation.
4. Copy the token: it is shown only once.
Open the token page at DigitalOcean
Vultr
Server · DNS
Portfolio import
Where to find the token
1. On the Vultr page that opens (Account → API), click “Enable API” if the API is not active yet.
2. Copy the Personal Access Token shown.
3. ⚠️ Under “Access Control”, add our address: 138.199.145.149 with subnet 32. Vultr only allows listed addresses — without this line the key is valid but our servers are refused.
4. Vultr only whitelists the address you enabled the API from: ours has to be added by hand.
Open the token page at Vultr
Akamai / Linode
Server · DNS
Portfolio import
Where to find the token
1. In the Cloud Manager (Akamai/Linode), open your profile at the top right, then “API Tokens”.
2. “Create a Personal Access Token”, add a label and the longest expiry.
3. Scopes: set “No Access” everywhere, then “Read/Write” on Domains only. That is the strict minimum.
4. Create, then copy the token: it is never displayed again.
Open the token page at Akamai / Linode
UpCloud
Server
Where to find the token
1. In the UpCloud Hub (hub.upcloud.com), open the account’s API access settings and create an API token.
2. Name it, pick the longest expiry (one year at most) and no IP address restriction.
3. Copy the token — it starts with ucat_ — : it is shown only once.
4. If UpCloud refuses the connection, allow the API first: “Account” page → “Allow API connections” (or, for a sub-account, People → Permissions).
Open the token page at UpCloud
AWS Lightsail
Server
Where to find the token
1. In the IAM console that opens, click your name at the top right, then “Security credentials”.
2. “Access keys” section → “Create access key”; use case: “Other”, then “Next”, then “Create access key”. Copy both values — the secret is visible only at that moment.
3. The region: it is written at the top right of the Lightsail console, in the form eu-west-3, us-east-1, eu-central-1… Servers in another region will not be seen — add a second connection if you have some elsewhere.
4. The IAM user must be allowed the lightsail:GetInstances action (the AmazonLightsailReadOnlyAccess policy is enough). Without it the key is valid but AWS refuses to list your servers.
Open the token page at AWS Lightsail
cPanel (o2switch, mutualisés)
Server · DNS
Portfolio import
Where to find the token
1. In your cPanel, “Security” section → “Manage API Tokens” → “Create”. Name it and copy it straight away: it is not shown again.
2. Find your server address: it is in cPanel, “General information” box (for example chabot.o2switch.net), and in your host's welcome email. It is not your website address.
3. Enter your cPanel username here, an at sign, then that address — for example: myaccount@chabot.o2switch.net
4. An API token is revoked from cPanel without changing your password: cutting the access costs you nothing.
Open the token page at cPanel (o2switch, mutualisés)
Plesk
Server
Where to find the token
1. In your Plesk, go to “Tools & Settings” → “Remote API (REST)”, then open “API Reference and Playground” (it will ask for your administrator password again — that password stays with Plesk).
2. In that reference, run the “POST /api/v2/auth/keys” call with an empty body { }: Plesk answers with a key, like 5c6f1a8a-1263-7444-24e5-fcfd7b4dcdc6. That key is what we ask for, never your password.
3. The server address is your Plesk panel address, without https:// and without :8443 — for example server.myhost.com. It is not your website address.
4. The key is revoked from the same reference (“DELETE /api/v2/auth/keys”) without touching your password: cutting the access costs you nothing.
Open the token page at Plesk
Fly.io
Server
Where to find the token
1. On the page that opens (fly.io → Tokens), create a PERSONAL access token.
2. Take the personal token, not a deploy token: a token limited to one app cannot see the rest of the account.
3. Copy it: Fly does not show it again.
Open the token page at Fly.io
Render
Server
Where to find the token
1. On the page that opens (Account Settings), open “API Keys” then “Create API Key”.
2. Name the key and create it.
3. Copy it: Render shows it only once.
Open the token page at Render
Railway
Server
Where to find the token
1. On the page that opens (Account → Tokens), click “Create Token” and name it.
2. Do NOT pick a team or a project in the list: a token limited to one scope is refused on the request that identifies the account.
3. Create, then copy the token: it is shown only once.
Open the token page at Railway
Heroku
Server
Where to find the token
1. On the page that opens (Account Settings), scroll to “API Key” and click “Reveal”.
2. Copy the key shown.
3. Avoid “Regenerate API Key”: the previous key stops working immediately, here and everywhere else.
Open the token page at Heroku
Scalingo
Server
Where to find the token
1. On the page that opens (my profile → “API tokens”), click “Generate new token” and name it.
2. Copy it straight away: Scalingo never shows it again.
3. Both regions (osc-fr1 and osc-secnum-fr1) are tried automatically: you have nothing to choose.
Open the token page at Scalingo

Every token is tried against the provider's API before it is accepted, then encrypted. A read, never a write, to verify.

Your provider is not listed?

Your domains are monitored exactly the same: the six watchers need no access. For a repair, DomainVigil shows you the exact record to copy and opens your provider's page. And tell us which one you need: that is how the list grows.

Suggest a provider