Plesk's REST API takes a secret key, sent in an X-API-Key header. Two rules shape everything below. Only a Plesk administrator can use the REST API, so the key belongs to one. And a key is bound to an IP address, which is where most failed setups come from.
The IP binding
A key works only from the IP address it was created for. If you leave the address out, Plesk uses the address of whoever made the request. Created from your laptop, the key then works from your laptop and nowhere else.
Create it for the address DNSense connects from. If you are not sure which that is, ask DNSense support first.
Option 1: the command line
On the Plesk server, run:
plesk bin secret_key -c -ip-address <IP address>
The output is the key. Copy it.
Option 2: the REST API
Send an empty JSON body to the key endpoint with basic authentication. Add an ip field to bind it, and optionally a description:
curl -X POST --user root:password \
-H "Content-Type: application/json" -H "Accept: application/json" \
-d '{"ip": "<IP address>", "description": "dnsense"}' \
"https://<host>:8443/api/v2/auth/keys"
The response is {"key": "..."}. Keys cannot be passed as URL arguments, only in the header.
Where to look in the panel
Tools & Settings > Remote API (REST) opens the API reference and playground. It is handy for testing the key. The key itself comes from the two methods above.
Connect it to DNSense
Add a connection, choose Plesk and fill in:
- Host of your panel. Port
8443is assumed. Name another port in the host if yours differs. - API key, the secret key you just made.
Test the key first with curl -H "X-API-Key: <key>" https://<host>:8443/api/v2/server. A JSON answer means it works from where you are. If DNSense still cannot connect, the IP binding is the first place to look.