---
title: "How to get a Dynadot API key and secret"
description: "Unlock the API page in your Dynadot account, copy the production key and secret, whitelist an IP address and connect Dynadot to DNSense."
canonical_url: "https://dnsense.io/learn/how-to-get-a-dynadot-api-key"
---

> Index of every page on this site: [llms.txt](https://dnsense.io/llms.txt)

Dynadot gives you two values, not one. The key identifies your account and the secret signs every request. DNSense needs both, and it needs the production pair, not the sandbox one.

## Find the keys

1. Log in to Dynadot, open **Tools** in the left menu and choose **API**.
2. Unlock your account with the link on that page. Dynadot hides the keys until you do.
3. Copy the **Production Key** and the **Secret Key**. The **Sandbox Key** and **Sandbox Secret Key** next to them belong to a test environment and will not show your real domains.

## Whitelist an IP address

The same page has an IP whitelist. It is optional, and it is the one setting that can break a working connection:

- Leave it empty and calls are accepted from anywhere.
- Fill it in and Dynadot refuses every other address, including DNSense unless you add ours.

Enter the address and click **Set IP Address**. CIDR ranges such as `/24` work too. Dynadot says changes can take at least 10 minutes to reach the API server, so a connection test right after saving may still fail. Lock your account again when you are done, as Dynadot advises.

## Connect it to DNSense

Add a connection, choose **Dynadot** and paste the **API key** and the **API secret** into their own fields. DNSense lists every domain on the account as a zone.

## What to expect

- **One TTL per domain.** Dynadot stores a single TTL for the whole record set, so changing the TTL of one record changes it for all of them.
- **Dynadot nameservers only.** Records are only managed while the domain uses Dynadot's own nameservers. If it delegates elsewhere, DNSense refuses the change, because the records would never answer.
- **The last record stays.** Dynadot cannot hold a zone without records, so the final record of a domain cannot be deleted from DNSense.
- **Supported types:** A, AAAA, CNAME, MX, TXT, CAA and SRV. Forwarding, stealth, email forwarding and ANAME entries are left as they are. Dynadot has no TLSA.
- **Rate limit.** A regular account gets 60 API calls per minute, so DNSense checks for drift on this connection at a measured pace.

Besides DNS, DNSense reads expiry dates and lock status, changes nameservers, requests transfer codes and can register a domain from your Dynadot balance.

If the connection fails, check the IP whitelist first. Then check that you pasted the production pair.

## Sitemap

See the full [sitemap](https://dnsense.io/sitemap.md) for all pages.