# About Authentication (https://developer.godaddy.com/en/docs/api-users/auth)

***

title: About Authentication
description: How GoDaddy API authentication works — credential types, PAT scopes, and account eligibility requirements.
agentNotes:
permissions: \["Any account"]
scopes: \["Not applicable — this page is conceptual"]
rateLimit: "API calls with PAT: rate-limited per credential per window. Go to /docs/api-users/rate-limits for current values."
idempotent: true
destructive: false
failureRecovery: "PAT reveals once at creation — if lost, revoke and regenerate. Revocation is instant across all edges."
related:
guides:

* title: "How to Authenticate"
  href: "/docs/api-users/auth/how-to"
* title: "Quickstart"
  href: "/docs/api-users/quickstart"
* title: "Set up the CLI"
  href: "/docs/api-users/cli-setup"
  concepts:
* title: "Handle errors"
  href: "/docs/api-users/errors"
* title: "Rate limits"
  href: "/docs/api-users/rate-limits"

***

## Overview

GoDaddy APIs use Bearer token authentication through a Personal Access Token (PAT) tied to specific capability scopes. PATs are required for all v3 Domains APIs. The legacy `sso-key` developer key is still supported for some APIs but is scheduled for deprecation and doesn't work for v3 endpoints. Go to [How to Authenticate](https://developer.godaddy.com/docs/api-users/auth/how-to) for step-by-step credential setup.

## Credential types

| Credential                  | Format                                  | Works with v3 | Status                              |
| --------------------------- | --------------------------------------- | ------------- | ----------------------------------- |
| Personal Access Token (PAT) | `Authorization: Bearer <token>`         | Yes           | Recommended                         |
| Classic Developer Key       | `Authorization: sso-key <key>:<secret>` | No            | Deprecated (supported through 2026) |

A PAT is scoped to specific capabilities, can be set to expire, and can be revoked individually without rotating any account-wide key pair. For most integrations, a PAT with the minimum required scopes is the right choice.

## Account requirements

Some operations require the account to meet specific eligibility rules regardless of credential type. A valid credential on an ineligible account is still refused with a `403 Forbidden` response and an `Error` code that distinguishes the reason from a missing scope. Check the `code` field on the response body, not just the HTTP status, to determine the reason. Go to [Handle errors](https://developer.godaddy.com/docs/api-users/errors) for the full error envelope and status code reference.

| Operation group                                                                | Requirement                                                                                                                                                                                               |
| ------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Domain management (list, DNS, contacts, renewals, lock, privacy)               | Account holds at least one domain, OR is on a plan that grants management access.                                                                                                                         |
| Registration, renewal, transfer (any operation that costs money in production) | Account has a valid billing method on file or a funded [Good as Gold](https://www.godaddy.com/help/what-is-good-as-gold-3359) balance. Go to [Set up a payment profile](https://developer.godaddy.com/docs/api-users/payment-profile). |

## PAT scopes

The following table lists the Domains API scopes you can assign when generating a PAT. Each scope enables specific operations. A write-scoped token satisfies read operations for the same resource; a read-scoped token is refused on writes. Go to [Generate a PAT](https://developer.godaddy.com/docs/api-users/auth/how-to#generate-a-token) for step-by-step instructions on how to generate a PAT.

When you generate a token, the **Domains & DNS** bundle in the scope picker selects all scopes below. You can expand it to grant a subset instead.

| Scope                       | Required to                                                            |
| --------------------------- | ---------------------------------------------------------------------- |
| `domains.domain:read`       | Read domain records, availability, suggestions, quotes, and operations |
| `domains.domain:create`     | Register domains                                                       |
| `domains.domain:update`     | Modify domain settings                                                 |
| `domains.domain:delete`     | Delete or cancel domains                                               |
| `domains.dns:update`        | Create, update, and delete DNS zone records                            |
| `domains.nameserver:update` | Replace authoritative nameservers for a domain                         |
| `domains.host:update`       | Modify domain host records                                             |
| `domains.forward:update`    | Configure domain forwarding                                            |
| `domains.contact:update`    | Update registrant, admin, or tech contacts                             |
| `domains.transfer:execute`  | Initiate an inbound domain transfer                                    |
| `domains.transfer:update`   | Modify a transfer in progress                                          |