Migrate to the new Hetzner DNS API

[jooola]

Dear maintainers,

This project holds a DNS provider for the old Hetzner DNS API.

A new Hetzner DNS API has been released.

We recommend any consumer of the old Hetzner DNS API to migrate to the new one.

The new Hetzner DNS API is currently in beta, which will likely end (reaching GA) on 10 November 2025. After the beta ended, it will no longer be possible to create new zones in the old DNS API (the old API will still be functional until May 2026). See the Hetzner DNS beta FAQ for more details.

Links:

• Hetzner DNS documentation: https://docs.hetzner.com/networking/dns
• Hetzner DNS API reference: https://docs.hetzner.cloud/reference/cloud#dns
• User migration guide to the new DNS system: https://docs.hetzner.com/networking/dns/migration-to-hetzner-console/process

If you have any additional questions, please let me know.

[github-actions]

Please upgrade to the latest code and try again first. Maybe it's already fixed. acme.sh --upgrade If it's still not working, please provide the log with --debug 2, otherwise, nobody can help you.

[PKlapp]

Problem statement

dnsapi/dns_hetzner.sh targets the legacy Hetzner DNS API. The new DNS API uses a different base URL and request schema, so all requests from the current script fail with an auth error.

Steps to reproduce

export HETZNER_Token="<token>"   # per acme.sh docs for dns_hetzner
export DOMAIN="<domain>"
./acme.sh --issue --debug 2 --dns dns_hetzner -d ${DOMAIN} -d test.${DOMAIN}

Actual result

All DNS calls fail with:

[Fri 10 Oct ...] url='https://dns.hetzner.com/api/v1/zones?name=<domain>'
[Fri 10 Oct ...] response='{"message":"Invalid authentication credentials"}'

Why this happens

• The provider script calls the legacy DNS API (https://dns.hetzner.com).
• The new DNS API lives under https://api.hetzner.cloud/v1/... and uses different endpoints (zones, rrsets).

Token check (new API)

# list zones (get ZONE_ID)
curl -s -H "Authorization: Bearer ${HETZNER_Token}" "https://api.hetzner.cloud/v1/zones"

# list rrsets for that zone
curl -s -H "Authorization: Bearer ${HETZNER_Token}" "https://api.hetzner.cloud/v1/zones/${ZONE_ID}/rrsets"

# create an RRset (example)
curl -s -X POST \
  -H "Authorization: Bearer ${HETZNER_Token}" \
  -H "Content-Type: application/json" \
  -d '{"name":"test","type":"A","ttl":3600,"records":[{"value":"<IPv4>","comment":"Test record"}]}' \
  "https://api.hetzner.cloud/v1/zones/${ZONE_ID}/rrsets"

Environment

• acme.sh: v3.1.2 (acme.sh --version)