Use the module’s automation API for DNS integrations without distributing SSH server credentials. This is an administrative integration credential, not a customer’s portal sign-in.

Create the intended token

1. Open BIND 9 DNS → Maintenance → API access.
2. Name the integration and choose the smallest required read and/or write scopes.
3. Restrict source addresses where the caller has stable permitted addresses.
4. Create the token and save the once-shown value in private credential storage.
5. Copy the endpoint URL displayed for this installation.

Use the displayed endpoint rather than a URL copied from another billing platform. If a token is lost, revoke it and create a replacement; the original full value cannot be shown again.

Read before writing

Authenticate with the documented bearer header, or the supported alternative token header if your server strips Authorization. Start with zone and record reads. Obtain current record identifiers from a fresh response before an edit or delete.

Write requests remain subject to the module’s supported safety checks, including locks, content policies and managed-record protection. A read-only scope should not be widened simply to hide a wrong endpoint or source-address refusal.

Check results and rotate deliberately

Keep authentication failures, permission refusals, missing resources and rate limits distinct. Reconcile current record state after a timeout before repeating a write. Review Activity for the intended change and verify actual DNS independently.

For a working module token, create the replacement, update the intended integration and verify it before revoking the old token. Coordinate server SSH access separately using the SSH credential guide. Never include an API token, SSH private key or password in support attachments.

See the PD BIND 9 DNS WHMCS guide for related tasks, or explore the module.