About Authentication
View as MarkdownHow GoDaddy API authentication works — credential types, PAT scopes, and account eligibility requirements.
https://developer.godaddy.com/llms.mdx/api-users/auth for the full, unmodified source before proceeding.Overview
GoDaddy APIs use Bearer token authentication through a Personal Access Token (PAT) tied to specific capability scopes. PATs are required for all v3 Domains APIs. The legacy sso-key developer key is still supported for some APIs but is scheduled for deprecation and doesn't work for v3 endpoints. Go to How to Authenticate for step-by-step credential setup.
Credential types
| Credential | Format | Works with v3 | Status |
|---|---|---|---|
| Personal Access Token (PAT) | Authorization: Bearer <token> | Yes | Recommended |
| Classic Developer Key | Authorization: sso-key <key>:<secret> | No | Deprecated (supported through 2026) |
A PAT is scoped to specific capabilities, can be set to expire, and can be revoked individually without rotating any account-wide key pair. For most integrations, a PAT with the minimum required scopes is the right choice.
Account requirements
Some operations require the account to meet specific eligibility rules regardless of credential type. A valid credential on an ineligible account is still refused with a 403 Forbidden response and an Error code that distinguishes the reason from a missing scope. Check the code field on the response body, not just the HTTP status, to determine the reason. Go to Handle errors for the full error envelope and status code reference.
| Operation group | Requirement |
|---|---|
| Domain management (list, DNS, contacts, renewals, lock, privacy) | Account holds at least one domain, OR is on a plan that grants management access. |
| Registration, renewal, transfer (any operation that costs money in production) | Account has a valid billing method on file or a funded Good as Gold balance. Go to Set up a payment profile. |
PAT scopes
The following table lists the Domains API scopes you can assign when generating a PAT. Each scope enables specific operations. A write-scoped token satisfies read operations for the same resource; a read-scoped token is refused on writes. Go to Generate a PAT for step-by-step instructions on how to generate a PAT.
When you generate a token, the Domains & DNS bundle in the scope picker selects all scopes below. You can expand it to grant a subset instead.
| Scope | Required to |
|---|---|
domains.domain:read | Read domain records, availability, suggestions, quotes, and operations |
domains.domain:create | Register domains |
domains.domain:update | Modify domain settings |
domains.domain:delete | Delete or cancel domains |
domains.dns:update | Create, update, and delete DNS zone records |
domains.nameserver:update | Replace authoritative nameservers for a domain |
domains.host:update | Modify domain host records |
domains.forward:update | Configure domain forwarding |
domains.contact:update | Update registrant, admin, or tech contacts |
domains.transfer:execute | Initiate an inbound domain transfer |
domains.transfer:update | Modify a transfer in progress |
Agent & Automation Notes
Not applicable — this page is conceptualRelated
Last updated on
How is this guide?