# Create a Porkbun API key

> InfraNest talks to Porkbun with an API key and a secret API key. Creating them takes a minute — but there is a second step that catches almost everybody, so…

Source: https://infranest.io/docs/create-a-porkbun-api-key
Last updated: 2026-10-08

---

Follow this guide to generate a Porkbun API key and secret key for InfraNest, and to make sure Porkbun actually lets that key do anything — a step almost everyone misses on the first try.

## Overview
- Porkbun requires two credentials — an **API key** and a **Secret API key** — to let InfraNest manage your domains.
- Creating the key only takes a minute, but Porkbun also requires you to switch on API access for your domains separately, or every change InfraNest tries will be refused.
- You can optionally lock the key down further with an IP allowlist, a domain allowlist, and spending controls.

## Create the key
1. Sign in to **Porkbun**.
2. Go to **Account** → **API Access** (porkbun.com/account/api).
3. Select **Create API Key** and give it a name you'll recognise, such as *InfraNest*.
4. Porkbun shows you an **API key** starting `pk1_` and a **Secret API key** starting `sk1_`.
5. Copy both and paste them into InfraNest — see **Connect Porkbun**.

> [!WARNING]
> The secret key is shown once. If you lose it, create a new key pair rather than trying to recover it.

## Then turn on API access for your domains

**This is the step people miss.** Creating a key does not, by itself, let it do anything to your domains. Porkbun controls API access **per domain**, and it is off by default.

The symptom is unmistakable once you know it: your domains all appear in InfraNest perfectly normally, and then every single change you try — nameservers, auto-renew, a DNS record — is refused. Nothing is wrong with your key.

You have two ways to fix it:

1. **All at once (recommended).** On the same **Account → API Access** page, turn on **Opt In All Domains**. New domains you register later are then included automatically.
2. **One domain at a time.** In your domain list at porkbun.com/account, open a domain and switch on its **API Access** toggle.

<!-- manual-screenshot: create-a-porkbun-api-key-1 — taken by hand on Porkbun's API Access page; the capture rig cannot reach it -->

<!-- docs-screenshots:start:create-a-porkbun-api-key-1 -->

![Create a Porkbun API key](/media/1feb4dce-2e27-41b1-9686-9c24f92d0e5d)

<!-- docs-screenshots:end:create-a-porkbun-api-key-1 -->

InfraNest marks any domain that is still opted out with a **NO API** flag and explains what to do, so if you only did some of them you can see which ones are left.

## Optional: restrict the key
Porkbun can lock a key down further. Both settings are optional and off unless you turn them on — find them behind the gear icon next to the key on the **API Access** page.

- **Source IP allowlist** — only accept requests from certain addresses. If you set this, add the IP address shown on InfraNest's Porkbun connect form, or every request will be refused no matter how correct your key is.
- **Target domain allowlist** — only allow the key to touch certain domains. It is an exact match, so listing `example.com` does not cover any other domain you own.

If you are not sure, leave both empty. That is Porkbun's default and it works.

## Optional: spending controls
Porkbun spends from your prepaid account credit, and the same **API Access** page can limit how much a key may spend per month and email you when the balance drops below an amount you choose. InfraNest reads both and shows them on the connection, so a monthly limit you set here will not surprise you later.

> [!NOTE]
> A monthly spend limit refuses charges even when your balance is healthy. If a renewal fails and the balance looks fine, check this setting.