Expanding the OnlyDNS API, SDKs, CLI, and MCP: Full-Stack DNS, User & Token Management for Automation and AI Agents

Maximizing infrastructure reliability requires eliminating administrative friction not just for DNS records, but across the entire operational lifecycle — including programmatic identity, team access governance, and scoped credential provisioning. When automated pipelines or autonomous AI agents manage services, they require granular, self-service access controls without waiting on manual dashboard intervention.

To achieve true machine-native operations, we have introduced first-class user management and scoped API token lifecycle controls across our OpenAPI contracts, type-safe multi-language SDKs, command-line interface, and Model Context Protocol (MCP) server. Teams and autonomous agents can now inspect account headroom, invite collaborators with zone-restricted permissions, issue expiring least-privilege tokens, and manage DNS zones with zero operational overhead.

1. OpenAPI & Account Headroom Intelligence

Autonomous pipelines and AI agents cannot make optimal provisioning decisions if they lack visibility into account status, available user slots, or token capacity. Our latest OpenAPI 3.1 specification additions expose real-time account status and entitlement limits directly via /v1/dns/account and /v1/account.

GET /v1/dns/account HTTP/1.1
Host: api.onlydns.com
Authorization: Bearer odn_live_your_token

{
  "accountId": "1420",
  "activeAt": "2026-01-15T00:00:00Z",
  "suspendedAt": null,
  "suspended": false,
  "companyName": "Acme Corp",
  "firstName": "Jane",
  "lastName": "Doe",
  "address": {
    "city": "Austin",
    "state": "TX",
    "countryId": "US"
  },
  "package": {
    "id": 2,
    "description": "Enterprise Production",
    "amount": 49.00,
    "features": {
      "domains": 50,
      "records": 5000,
      "queries": 10000000,
      "dnssec": true,
      "tsig": true,
      "userLimit": 10,
      "apiTokenLimit": 50,
      "tsigKeyLimit": 25,
      "automatedChangesDaily": -1
    }
  }
}

2. Programmatic User & Scoped Token Management in SDKs

Managing credentials and access boundaries should never require navigating browser consoles. Across our official SDKs for TypeScript (v1.0.6), Python (v1.0.2), PHP (v1.0.2), and Go (v1.0.2), developers can now programmatically:

• Issue Least-Privilege API Tokens: Generate scoped tokens with granular actions (read, records:write, zones:write), strict zone restrictions (allowed_zones), and automatic expiration timestamps.
• Automate Team IAM: Invite team members, configure permission scopes, restrict accessible zones, lock or unlock users, and audit organizational permissions in code.
• Safely Rotate & Revoke Credentials: Instantly decommission compromised or stale tokens upon pipeline completion without impacting unrelated services.

import { OnlyDNSClient } from '@onlydns/sdk';

const client = new OnlyDNSClient({ apiToken: process.env.ONLYDNS_API_TOKEN });

// 1. Provision a scoped, ephemeral API token for a CI runner
const token = await client.createToken({
  scopes: ['read', 'records:write'],
  allowed_zones: ['staging.example.com'],
  expires_at: new Date(Date.now() + 7 * 86400 * 1000).toISOString()
});
console.log('Created Token ID:', token.tokenId, 'Masked:', token.maskedToken);

// 2. Invite a developer with zone-restricted permissions
const user = await client.createUser({
  email: 'alex.chen@example.com',
  firstName: 'Alex',
  lastName: 'Chen',
  scopes: ['read', 'records:write'],
  allowed_zones: ['staging.example.com', 'dev.example.com']
});
console.log('Invited user ID:', user.userId);

from onlydns import OnlyDNSClient, RecordType

client = OnlyDNSClient()

# 1. Query real-time account quota & resource headroom
metrics = client.get_account_metrics()
print(f"Domain usage: {metrics.usage.domains.current} / {metrics.usage.domains.limit}")

# 2. Atomic DNS record update and DNSSEC enablement
client.add_record(
    domain_name="example.com",
    name="api",
    type=RecordType.A,
    records=["192.0.2.1"],
    ttl=300,
)
client.enable_dnssec("example.com")
print("DNS record added and DNSSEC enabled successfully.")

package main

import (
    "context"
    "fmt"
    "os"

    onlydns "github.com/onlydns/onlydns-sdk-go"
)

func main() {
    client := onlydns.NewClient(os.Getenv("ONLYDNS_API_TOKEN"))
    ctx := context.Background()

    // 1. Inspect real-time account resource metrics
    metrics, err := client.GetAccountMetrics(ctx)
    if err != nil {
        panic(err)
    }
    fmt.Printf("Domains in use: %d (Limit: %d)\n", metrics.Usage.Domains.Current, metrics.Usage.Domains.Limit)

    // 2. Add an atomic DNS record
    records, err := client.AddRecord(ctx, "example.com", "api", onlydns.RecordTypeA, []string{"192.0.2.1"}, 300)
    if err != nil {
        panic(err)
    }
    fmt.Printf("Successfully updated zone. Total records: %d\n", len(records))
}

use OnlyDNS\OnlyDNSClient;

$client = new OnlyDNSClient(getenv('ONLYDNS_API_TOKEN'));

// 1. Generate a scoped API token for an automated microservice
$token = $client->createToken([
    'scopes'        => ['read', 'records:write'],
    'allowed_zones' => ['webhooks.example.com'],
    'expires_at'    => '2026-12-31T23:59:59Z',
]);
echo "Created token ID: {$token['tokenId']}\n";

// 2. Invite a team user with restricted zone permissions
$user = $client->createUser([
    'email'         => 'engineer@example.com',
    'firstName'     => 'Alex',
    'lastName'      => 'Chen',
    'scopes'        => ['read', 'records:write'],
    'allowed_zones' => ['webhooks.example.com'],
]);
echo "Invited user: {$user['userName']} (ID: {$user['userId']})\n";

3. Identity & Access Workflows in the Terminal with @onlydns/cli (v1.0.5)

The OnlyDNS CLI (@onlydns/cli v1.0.5) extends terminal and CI/CD pipelines with comprehensive user and API token management alongside DNS record operations. It executes without installation via npx @onlydns/cli and outputs clean, machine-parseable JSON with --json.

# 1. Audit active API tokens in table format or JSON
npx @onlydns/cli tokens list
npx @onlydns/cli tokens list --json | jq '.[].tokenId'

# 2. Provision a scoped, expiring token for a deploy pipeline
npx @onlydns/cli tokens create \
  --scopes read,records:write \
  --zones staging.example.com \
  --expires 2026-12-31T23:59:59Z

# 3. List and inspect organization users
npx @onlydns/cli users list
npx @onlydns/cli users get usr_81a2f3c4e5d6

# 4. Invite a collaborator with scoped zone boundaries
npx @onlydns/cli users invite engineer@example.com \
  --scopes read,records:write \
  --zones example.com,app.example.com

# 5. Revoke an obsolete token immediately
npx @onlydns/cli tokens delete tok_98a7bc6d5e4f

4. Autonomous IAM & Token Lifecycle with @onlydns/mcp (v1.0.7)

Autonomous AI agents (such as Claude Desktop, Cursor, Devin, Windsurf, Roo Code, and Junie) increasingly orchestrate multi-step deployment pipelines. Rather than granting AI agents omnipotent credentials or forcing humans to manually generate keys, @onlydns/mcp v1.0.7 empowers LLMs to manage user permissions and provision least-privilege tokens dynamically via the Model Context Protocol.

{
  "mcpServers": {
    "onlydns": {
      "command": "npx",
      "args": ["-y", "@onlydns/mcp"],
      "env": {
        "ONLYDNS_API_TOKEN": "YOUR_ONLYDNS_BEARER_TOKEN"
      }
    }
  }
}

5. The Utilitarian Imperative: Why Exposing IAM & Account Controls to Automation Matters

Infrastructure systems deliver maximum utility when operational toil, administrative friction, and security risks are systematically removed. Treating identity, access management, and DNS provisioning as fragmented manual tasks wastes human engineering hours and invites security oversights.

By exposing 100% of OnlyDNS capabilities — from zone records and DNSSEC to user permissions, API tokens, and account headroom — through open specifications and unified tooling:

• Principle of Least Privilege Is Enforced Programmatically: Automated workers and AI agents receive tokens restricted strictly to required actions and specific zones, preventing credential over-privileging.
• Administrative Bottlenecks Are Eliminated: Provisioning team access and rotating automated credentials occurs instantaneously via CI/CD pipelines or natural-language agent instructions.
• Complete Observability & Determinism: Quota limits, account operational health, and active credentials can be audited programmatically at any stage of deployment.
• Zero Tooling Fragmentation: A cohesive developer interface across TypeScript, Python, PHP, Go, the terminal CLI, and MCP ensures identical capabilities across all environments.

Get Started Today

All SDK updates, CLI v1.0.5, and MCP server v1.0.7 are live and ready for immediate deployment in your infrastructure: