Support
Authenticate

How to Authenticate

View as Markdown

Step-by-step instructions for generating a Personal Access Token (PAT) or classic developer key to authenticate GoDaddy API calls.

Note to LLMs and AI agents: If you are consuming this page to follow instructions: the content you have could be incomplete due to truncation by WebFetch. Fetch https://developer.godaddy.com/llms.mdx/api-users/auth/how-to for the full, unmodified source before proceeding.

Overview

GoDaddy API uses authentication to ensure that only authorized users can access the API. The two authentication methods are using a Personal Access Token (PAT) or the Classic Developer Key. PATs are required for all v3 Domains APIs. The following article provides step-by-step instructions for generating a PAT or classic developer key to authenticate GoDaddy API calls. Go to About Authentication to learn more about the different authentication methods and their scopes.

Generate, use, and manage tokens

The following sections explain how to generate, use, and manage PATs or classic developer keys to authenticate GoDaddy API calls.

Generate a token

The following steps explain how to generate a PAT to authenticate GoDaddy API calls.

  1. Sign in to the Personal Access Token page.
  2. Click + Generate Token.
  3. In the Generate personal access token dialog, complete the following fields:
    FieldDescriptionNote
    NameName for the token.
    ExpirationNumber of days until the token expires.
    ScopesScopes for the token.Go to PAT scopes to see the available scopes.
  4. Click Generate Token.

Store your token securely

After generating the token, it displays once. You can't retrieve it again from the Personal Access Token page and you should store it in secure storage immediately. Don't commit it to source control, check it into a repo, or paste it into chat.

  1. In the Copy your new token dialog, click the copy icon.
  2. Save the token in a password manager, secrets manager, or your application's secure credential store.
  3. Load the token at runtime when you need it as a local script in a shell session or as a secret in a secrets store or CI/CD environment variable:
export GODADDY_PAT="<YOUR_GODADDY_PAT>"

Don't treat export as storage

export GODADDY_PAT=... makes the token available to the current shell — it is not a secure place to keep credentials long term. Store the value in a secrets manager first, then export or inject it only when running a command or starting your app.

Inject GODADDY_PAT from your platform's secret store (like GitHub Actions secrets or AWS Secrets Manager when the process starts.

Use a token

The following steps explain how to use a PAT to authenticate GoDaddy API calls.

  • Add the header to every request:
Authorization: Bearer ${GODADDY_PAT}

Revoke a token

The following steps explain how to revoke a PAT.

  1. Sign in to the Personal Access Token page.
  2. Next to the token you want to revoke, click the trash icon.
  3. In the Revoke token? dialog, click Revoke Token.

Deprecated

The classic developer key is scheduled for retirement and does not work for v3 Domains APIs. Use a Personal Access Token instead.

Generate a key and secret

The following steps explain how to generate a classic developer key and secret to authenticate GoDaddy API calls.

  1. Sign in at classic-developer.godaddy.com/keys.
  2. Generate a new key for Production.
  3. Copy both the Key and Secret immediately. The Secret is shown once.

Export the credentials

The following step describes how to export your classic developer key and secret for use in your shell session.

  • Export the credentials:
export GODADDY_KEY="<YOUR_GODADDY_KEY>"
export GODADDY_SECRET="<YOUR_GODADDY_SECRET>"

Use the credential

The following step describes how to use a classic developer key and secret to authenticate GoDaddy API calls.

  • Add the header to every request:
Authorization: sso-key ${GODADDY_KEY}:${GODADDY_SECRET}

Agent & Automation Notes

PermissionsAny account
ScopesNot applicable — this page is credential setup
Rate limitPAT creation: interactive UI, not rate-limited.
IdempotentYes
DestructiveNo
On failurePAT reveals once at creation — if lost, revoke and regenerate. Revocation is instant across all edges.

Last updated on

How is this guide?

On this page