DNS providers
Per-provider authentication and required permissions for the 18 DNS providers CertAutoPilot speaks for DNS-01 challenge automation.
Overview
For DNS-01, the worker creates a temporary TXT record at _acme-challenge.<name>, waits for the CA to validate it, then deletes the record. CertAutoPilot scopes the credential to the smallest permission that allows that — typically zone-level DNS edit, never account-wide write.
Cloudflare
Create an API Token with Zone → DNS → Edit scoped to the relevant zone. Paste the token. Account ID and zone ID are auto-discovered.
Permissions: Zone → DNS → Edit
Zone Resources: Include → Specific Zone → example.com
AWS Route 53
IAM access keys only. Attach this minimum policy to the user:
{"Effect":"Allow",
"Action":["route53:ChangeResourceRecordSets","route53:GetChange","route53:ListResourceRecordSets"],
"Resource":["arn:aws:route53:::hostedzone/Z123ABC..."]}
Instance-profile / IMDSv2 and AssumeRole are not supported — the credential requires an access key ID and secret.
Google Cloud DNS
Create a service account with role DNS Administrator on the target zone. Download the JSON key and paste it into the credential. A key is required — Workload Identity (keyless) is not yet supported.
Azure DNS
Service principal with role DNS Zone Contributor on the resource group. Required fields: tenant ID, subscription ID, client ID, client secret. Only client-secret authentication is supported — managed identity and federated workload identity are not.
DigitalOcean
Personal Access Token with read + write scope. There is no zone-level scoping; this is the only DO option.
GoDaddy
API key + secret pair. Production keys come from the Production tab; do not use the OTE/sandbox keys.
AWS Lightsail
IAM user with lightsail:*Domain*. Lightsail DNS is a different API from Route 53 even though they're both AWS.
UltraDNS
Username + password against the v3 REST API. Use a dedicated automation account with restricted IP allow-listing.
Akamai EdgeDNS
EdgeGrid credentials (host, client_token, client_secret, access_token). Generate from the Akamai Control Center → Identity & Access → API Clients. Required permission: DNS-Zone-Record-Management — READ-WRITE.
Hetzner
API token from the Hetzner DNS Console. There is one global scope; scope by zone via separate tokens if you need least-privilege.
OVH
Application key + application secret + consumer key. Generate via OVH's Create Token tool with paths GET/POST/DELETE /domain/zone/*.
Namecheap
Username + API key, plus the public IP of every worker (Namecheap requires IP allow-listing on the API). For Kubernetes, this means a static egress IP via a NAT gateway.
RFC 2136 (Dynamic DNS)
For a self-hosted authoritative server (BIND, PowerDNS, Knot, or a Windows DNS zone), CertAutoPilot writes the challenge with an RFC 2136 dynamic update instead of a cloud API. Enable dynamic updates on the zone and choose an auth mode: TSIG (shared key — BIND/PowerDNS/etc.), GSS-TSIG (Kerberos — Windows "secure dynamic update"), or Nonsecure (firewalled). Full walkthrough — including how to turn dynamic updates on and what TSIG is — in RFC 2136 (Dynamic DNS).
For a Windows AD-integrated "Secure only" zone where Kerberos setup on the CertAutoPilot host isn't desired, see Windows DNS (WinRM) — it writes the record over WinRM/PowerShell with no TSIG/Kerberos.
Hostinger
Single personal API token for domains on Hostinger DNS — common for small/SMB sites. Details in Hostinger.
cPanel / WHM
Write DNS-01 records through a cPanel account or a WHM (reseller/root) server via an API token — covering the large share of shared hosting on cPanel. Provide the panel URL (cPanel :2083 / WHM :2087), username, token, and interface. See cPanel / WHM.
Plesk
Write records through a Plesk server (URL + username + password) — the dominant panel on Windows hosting. See Plesk.
DirectAdmin
Write records through a DirectAdmin server (URL + username + password/login key). An optional zone name skips the public-DNS zone lookup for internal domains. See DirectAdmin.
Testing the credential
Every credential form has a Test button. With a domain it does a real round-trip against the provider — creates a temporary TXT and deletes it — proving auth + write access. Always run it before relying on a credential.
Panel providers (cPanel/WHM, Plesk, DirectAdmin) and Hostinger: the test (like issuance) resolves the zone via public DNS first, so the test domain must have a public SOA — use a real domain the panel manages. DirectAdmin is the exception: set its optional Zone Name to skip the public-DNS lookup entirely, which lets you validate against an internal-only or lab domain. cPanel/Plesk/DirectAdmin also require the panel to be reachable from CertAutoPilot over HTTPS on its admin port.