Connectors

A connector is a read-only link to a DNS provider. NoCert reads the zones in your account, along with the host-bearing record names inside them.

What happens next depends on what you have verified. A name that falls inside a domain you already verified is queued for a scan. A zone you have not added yet is proposed on Domains, and still becomes a domain you verify, the same as one you typed by hand.

NoCert supports Cloudflare and Route 53. Operators and owners can manage connectors; viewers cannot see the screen.

Cloudflare

Create an account-owned API token: Manage Account → Account API Tokens → Create Token, which needs Super Administrator access. If you cannot create account-owned tokens, My Profile → API Tokens works as a fallback.

Give it exactly two permission rows and remove everything else:

Zone / Zone / Read
Zone / DNS / Read

Under Zone Resources, include the specific zones you want NoCert to see, or all zones for full coverage.

Paste the token into Connectors → Cloudflare.

Caution

Never use the Global API Key. It carries your own Cloudflare permissions across every resource you can reach, and NoCert needs read access to zones and nothing more.

Route 53

Create an IAM policy granting the two read-only actions NoCert calls:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "NocertRoute53ReadOnly",
    "Effect": "Allow",
    "Action": [
      "route53:ListHostedZones",
      "route53:ListResourceRecordSets"
    ],
    "Resource": "*"
  }]
}

Attach it to a dedicated IAM user, create an access key, and paste the key ID, secret and region into Connectors → Route 53.

Saving a connector

Name the connector before anything else. The name is required, and it is what tells two accounts of the same provider apart.

Then select Test connection. Save stays disabled until a test succeeds against the credentials currently in the form, and a credential that connects but sees no zone does not count: fix the permissions or the zone resources and test again.

What a sync does

A sync lists the zones the credential can see, with the apex and every A, AAAA and CNAME record name in them, and compares those names with the domains you have verified. Names inside a verified domain are queued for a scan straight away. Zones with nothing in scope appear in Suggested domains on the Domains page.

Adding a suggested zone creates the domain and opens the verification dialog, and discovery starts once that record resolves.

Verifying a domain also refreshes your connectors, so a zone you have just proved you own stops being suggested.

Several accounts

You can connect more than one account per provider. Give each connector a name you will recognize later, since that name is how the two are told apart on the list.

Rotating a credential

Edit the connector and paste the replacement. Leaving the field empty keeps the current one, which is why the form shows only the last few characters of what is stored.

Rotate on the provider’s side first, then update NoCert. A token you revoke before replacing it here leaves the connector failing until you do.

Credentials are encrypted at rest. NoCert only ever reads with them.