Skip to main content
GoDaddy has no third-party sign-in flow, so there is no Connect with GoDaddy button to look for. A Personal Access Token is the only way to authorize Maski, and it is straightforward to mint.
Maski needs two scopes: domains.domain:read, to confirm your account holds the domain, and domains.dns:update, to publish the records. Leave the rest of the Domains and DNS bundle unticked.
Until April 2026 GoDaddy restricted API access to accounts holding ten or more domains or a Discount Domain Club membership. That restriction has been lifted. A single domain in your account is now enough.

​
Create the token

1

Open the Personal Access Token page

Sign in and go to developer.godaddy.com/personal-access-token. Choose Generate Token.
2

Name it and set an expiry

Give the token a name you will recognise later, for example Maski DNS setup, and set the number of days until it expires. Maski uses the token once, so a short expiry costs you nothing.
3

Pick the two scopes

The scope picker groups everything under Domains & DNS. Selecting the bundle grants every scope in it, which is more than Maski needs. Expand it instead and tick only:
  • domains.domain:read
  • domains.dns:update
4

Copy the token

Choose Generate Token. GoDaddy shows the value once and cannot show it again from this page. Copy it before you close the dialog.
5

Paste it into Maski

Open your domain in the Maski dashboard. In Set up automatically, pick GoDaddy, paste the token into Personal Access Token, and press Review changes.Maski reads your zone and shows you what it would change. Nothing is written until you press Publish records.

​
Afterwards

Revoke the token from the same page once your domain is set up. Maski does not keep it and will not need it again.

​
Two GoDaddy specifics

Your records will show a TTL of 600 seconds. GoDaddy rejects anything shorter. Maski’s default is 300, so every record it writes at GoDaddy is raised to GoDaddy’s minimum. This has no effect once the domain is verified. Replacing a record removes and recreates it. GoDaddy’s API cannot edit a record in place, so when Maski has to change the value of a record it manages, it deletes that exact record and writes the new one. This only ever applies to the specific record being written, only while a domain is still being set up and not yet routing mail, and a failed attempt is fixed by simply running setup again.

​
If it does not work

“Your DNS provider rejected the request.” The token is missing domains.dns:update, or it has expired. Tokens are short-lived by design, so if some time passed between minting and pasting, mint a fresh one. Maski cannot find the zone. The domain has to be registered in the same GoDaddy account the token belongs to, and GoDaddy has to be its DNS host. If you moved nameservers elsewhere, set the domain up at whichever provider now answers for it. If neither helps, add the records by hand from the checklist on the domain page. A manually configured domain works exactly the same.