Replace the provider credential saved in PD Plesk DNS without changing the intended server, account or source-address restrictions. Creating a key in Plesk does not update the saved connection automatically.

Prepare the replacement

Identify the provider and the integrations using its current credential. Have the responsible administrator create a replacement XML API secret key for the intended Plesk account and the billing server’s actual outgoing address, using Plesk’s supported key-management process.

Plesk shows a newly created key only once. Store it privately and keep the existing key available until the replacement has been checked. Review scope separately from the descriptive key name; see the connection guide for account and setup requirements.

Replace and verify

1. Open Plesk DNS → Providers and edit the intended provider.
2. Use Replace on API key (secret key) and enter the complete replacement value.
3. Run Test connection and save the provider.
4. Read a known domain and its current records.
5. Check any intended optional operation separately.
6. Have the administrator retire the old key once all agreed uses have moved.

The test checks server information; it is separate from permission for DNS and mail actions. If a result is uncertain, inspect the saved connection and actual operation before rotating again.

Diagnose a refused replacement

Check the complete key value, account scope, source restriction, hostname, certificate and API port. A changing outgoing address can invalidate an IP-bound credential even when the key was copied correctly.

Retain the original action time and redacted result while your hosting team checks the intended replacement. Do not send either key value. Rotating a Plesk credential does not rotate the module’s separate automation tokens.

Check the replacement API key

Your hosting team should confirm that the replacement XML API secret key was saved on the intended provider and assigned to the intended account and actual outgoing address. Compare hostname, certificate and port separately from credential validity. Read a known domain and inspect the originally refused operation before creating another key; rotation cannot restore a missing native domain or change its ownership. Account for other uses before retiring the old key.

See the PD Plesk DNS Blesta guide for related tasks, or explore the module.