Use module API access for a backend integration that needs to read or change DNS. Its token is separate from the Google service-account JSON and from a customer’s portal credential.

Prepare the integration token

1. Open Google Cloud DNS → Maintenance → API access.
2. Name the integration and choose read or write scope as needed.
3. Restrict source IPs when the caller has a fixed outbound address.
4. Store the one-time token privately.
5. Copy this installation’s endpoint directly from the panel.

Platform endpoints differ. Use one token per integration for attribution and rotation; do not expose it in browser JavaScript or assume an administrative token is restricted to one customer’s zone.

Read and identify before writing

Use HTTPS with Authorization: Bearer authentication. The documented X-Api-Token header is an alternative where the server strips the standard header. Keep credentials out of logs and support attachments.

Use GET with action=zones for tracked zones, then action=records and the selected zone for current records. Confirm the full name/type and intended value before preparing an edit. The zones response is capped at 1,000 tracked entries; an absent row is not proof the provider has no such zone. Record operations select the first tracked match for the requested DNS name, without a project/provider selector. If that name is tracked under several connections, have your hosting team establish the intended mapping before API writes.

Submit and reconcile

Use POST with addrecord, editrecord or delrecord. Edits/deletes need recid from a live records result; deletion also confirms type and name. Supply priority, weight and port for types that require them.

Read back the complete affected record set and shared TTL. A timeout can follow a successful provider write, so reconcile actual state before retrying. Locks, content policy and managed-record protection still apply; an API token is not a workaround for a refused customer edit.

Review 401, 403, 404 and 429 separately and back off when rate limited. Rotate by creating the replacement, switching and verifying the integration, then revoking the old token. Check Maintenance and Activity for the original operation result.

See the PD Google Cloud DNS WHMCS guide for related tasks, or explore the module.