When creating an API token, allow users to restrict DNS permissions to specific domains or DNS zones.

A common use case is Let’s Encrypt DNS-01 validation. An ACME client temporarily creates a TXT record to prove control of a domain. With DigitalOcean, a token granted domain:update can modify DNS records for every domain accessible within the team, even when the client needs access to only one zone.

For example, users should be able to create a token with permissions such as:

Read and update DNS records

Limited to example.com

No permission to create or delete domains

No access to other DNS zones or DigitalOcean resources

Zone-scoped tokens would follow the principle of least privilege and significantly reduce the potential impact of a leaked or compromised API token. This would be particularly valuable for ACME clients, external-dns, CI/CD systems, and other automated DNS integrations.