> For the complete documentation index, see [llms.txt](https://docs.dnscontrol.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dnscontrol.org/provider/websupport.md).

# WebSupport

## Configuration

To use this provider, add an entry to `creds.json` with `TYPE` set to `WEBSUPPORT` along with your WebSupport API key and secret. Both are generated in the [Security section](https://admin.websupport.sk/en/auth/security) of the WebSupport admin console.

Example:

{% code title="creds.json" %}

```json
{
  "websupport": {
    "TYPE": "WEBSUPPORT",
    "api_key": "your-api-key",
    "secret": "your-api-secret"
  }
}
```

{% endcode %}

You can also use environment variables:

{% code title="creds.json" %}

```json
{
  "websupport": {
    "TYPE": "WEBSUPPORT",
    "api_key": "$WEBSUPPORT_API_KEY",
    "secret": "$WEBSUPPORT_SECRET"
  }
}
```

{% endcode %}

### Metadata

This provider does not recognize any special metadata fields unique to WebSupport.

### Usage

An example configuration:

{% code title="dnsconfig.js" %}

```javascript
var REG_NONE = NewRegistrar("none");
var DSP_WEBSUPPORT = NewDnsProvider("websupport");

D("example.com", REG_NONE, DnsProvider(DSP_WEBSUPPORT),
    A("@", "1.2.3.4"),
    CNAME("www", "@"),
    MX("@", 10, "mail.example.com."),
);
```

{% endcode %}

## Activation

DNSControl uses the [WebSupport REST API v2](https://rest.websupport.sk/v2/docs) to manage your DNS records. Generate an API key and secret in the [Security section](https://admin.websupport.sk/en/auth/security) of the admin console.

Authentication uses HTTP Basic auth where the username is the API key and the password is a per-request HMAC-SHA1 signature derived from the secret. The secret itself is never transmitted.

### Notes and limitations

* **Zones must already exist.** The API has no endpoint to create a zone or to enumerate all zones, so `create-domains` and `get-zones` are not supported. Add domains through the WebSupport portal first.
* **Supported record types:** `A`, `AAAA`, `CNAME`, `MX`, `TXT`, and `SRV`.
* **Unsupported record types**, due to WebSupport v2 API limitations:
  * `NS` — the API silently ignores attempts to create NS records, so they are rejected to avoid an endless create loop. Apex nameservers are managed by WebSupport and are not exposed through the DNS record API.
  * `CAA` — the API does not return the `tag`/`flags` of a CAA record on read, so the record cannot be managed without churn.
  * `ALIAS`/`ANAME` — WebSupport only allows `ANAME` at the apex and rejects it when other apex records exist, so it cannot be supported generically.
  * `LOC`, `NAPTR`, `PTR`, `SSHFP`, `TLSA`, `DS`.
* **`TXT` records may not end in a space.** The API silently strips trailing whitespace, so such records are rejected rather than churning forever.
* **Null MX (**[**RFC 7505**](https://www.rfc-editor.org/rfc/rfc7505.html)**) is not supported.** A null MX has an empty target and the API rejects a record with empty `content`, so `MX("@", 0, ".")` is rejected with a clear error.
* **MX and SRV reads cost one extra API request each.** WebSupport's record listing endpoints return `null` for `priority`, `port` and `weight` on every record, even though the values are stored correctly and served in DNS. The provider re-reads each `MX` and `SRV` record through the v1 single-record endpoint, which still reports them. This is a workaround for a bug on WebSupport's side and stops by itself once they fix the listing.
* The provider automatically resolves each domain to its numeric WebSupport service id (used internally by the v2 API); you only need to supply `api_key` and `secret`.

### Feature Summary

* Provider Type
  * [Official Support](/provider/index.md#providers-with-official-support): ❌
  * DNS Provider: ✅
  * Registrar: ❌
* Provider API
  * [Concurrency Verified](/advanced-features/concurrency-verified.md): ❔
  * [dual host](/advanced-features/dual-host.md): ❌
  * create-domains: ❌
  * [get-zones](/commands/get-zones.md): ❌
* DNS extensions
  * [`ALIAS`](/language-reference/domain-modifiers/alias.md): ❌
  * [`DNAME`](/language-reference/domain-modifiers/dname.md): ❔
  * [`LOC`](/language-reference/domain-modifiers/loc.md): ❌
  * [`PTR`](/language-reference/domain-modifiers/ptr.md): ❌
  * [`SOA`](/language-reference/domain-modifiers/soa.md): ❌
* Service discovery
  * [`DHCID`](/language-reference/domain-modifiers/dhcid.md): ❔
  * [`NAPTR`](/language-reference/domain-modifiers/naptr.md): ❌
  * [`SRV`](/language-reference/domain-modifiers/srv.md): ✅
  * [`SVCB`](/language-reference/domain-modifiers/svcb.md): ❔
* Security
  * [`CAA`](/language-reference/domain-modifiers/caa.md): ❌
  * [`HTTPS`](/language-reference/domain-modifiers/https.md): ❔
  * [`SMIMEA`](/language-reference/domain-modifiers/smimea.md): ❔
  * [`SSHFP`](/language-reference/domain-modifiers/sshfp.md): ❌
  * [`TLSA`](/language-reference/domain-modifiers/tlsa.md): ❌
* DNSSEC
  * [`AUTODNSSEC`](/language-reference/domain-modifiers/autodnssec_on.md): ❔
  * [`DNSKEY`](/language-reference/domain-modifiers/dnskey.md): ❔
  * [`DS`](/language-reference/domain-modifiers/ds.md): ❌