# Create a Porkbun API key

> InfraNest talks to Porkbun with an API key and a secret API key. Creating them takes a minute — but there is a second step that catches almost everybody, so…

Source: https://infranest.io/docs/create-a-porkbun-api-key
Last updated: 2026-08-30

---

This article shows you how to create a Porkbun API key and secret key so InfraNest can manage your domains — for anyone connecting a Porkbun account to InfraNest.

## Overview
- InfraNest connects to Porkbun using two pieces of information: an API key and a secret API key.
- Creating the key pair only takes a minute, but there's a second, easy-to-miss step that must be done before InfraNest can actually change anything on your domains.
- You can also optionally lock the key down further and set spending controls, both from the same Porkbun page.

## Create the key
1. Sign in to **Porkbun**.
2. Go to **Account** → **API Access** (porkbun.com/account/api).
3. Select **Create API Key** and give it a name you'll recognise, such as *InfraNest*.
4. Porkbun shows you an **API key** starting `pk1_` and a **Secret API key** starting `sk1_`.
5. Copy both and paste them into InfraNest — see **Connect Porkbun**.

> [!WARNING]
> The secret key is shown once. If you lose it, create a new key pair rather than trying to recover it.

## Turn on API access for your domains
This is the step people miss. Creating a key does not, by itself, let it do anything to your domains. Porkbun controls API access **per domain**, and it is off by default.

The symptom is unmistakable once you know it: your domains all appear in InfraNest perfectly normally, and then every single change you try — nameservers, auto-renew, a DNS record — is refused. Nothing is wrong with your key.

You have two ways to fix it:

1. **All at once (recommended).** On the same **Account → API Access** page, turn on **Opt In All Domains**. New domains you register later are then included automatically.
2. **One domain at a time.** In your domain list at porkbun.com/account, open a domain and switch on its **API Access** toggle.

InfraNest marks any domain that is still opted out with a **NO API** flag and explains what to do, so if you only did some of them you can see which ones are left.

## Restrict the key (optional)
Porkbun can lock a key down further. Both settings are optional and off unless you turn them on — find them behind the gear icon next to the key on the **API Access** page.

1. **Source IP allowlist** — only accept requests from certain addresses. If you set this, add the IP address shown on InfraNest's Porkbun connect form, or every request will be refused no matter how correct your key is.
2. **Target domain allowlist** — only allow the key to touch certain domains. It is an exact match, so listing `example.com` does not cover any other domain you own.

If you are not sure, leave both empty. That is Porkbun's default and it works.

## Set spending controls (optional)
Porkbun spends from your prepaid account credit, and the same **API Access** page can limit how much a key may spend per month and email you when the balance drops below an amount you choose. InfraNest reads both and shows them on the connection, so a monthly limit you set here will not surprise you later.

> [!NOTE]
> A monthly spend limit refuses charges even when your balance is healthy. If a renewal fails and the balance looks fine, check this setting.

## Tips
- Name your key something recognisable, like *InfraNest*, so you can identify it later if you manage multiple keys.
- Turning on **Opt In All Domains** saves you from repeating the per-domain step every time you register a new domain.

## Troubleshooting
- **Every change is refused, but the key looks correct:** almost always means API access is still off for that domain. Check the **NO API** flag InfraNest shows and turn on **API Access** for the domain, or use **Opt In All Domains**.
- **Requests are refused even though the key is right:** check whether a **Source IP allowlist** is set on the key — it will block everything unless InfraNest's IP address is added.
- **A renewal fails and your balance looks fine:** check the monthly spend limit under spending controls on the **API Access** page.