Connect a provider account with a key

Keeps a DNS provider or registrar key for the workspace, encrypted (GRANT_ENCRYPTION_KEY; 503 without it). The key is checked first by listing the provider's domains, or, for a provider that cannot list them, by reading one of the selected domains or check_domain; with neither, 400 check_domain_required, and a key is never kept unchecked. access is continuous (kept until revoked, used only to put back records it wrote that disappear where the deployment has automatic repair on, remove records when a domain is removed, and re-apply the records it wrote on request) or one_time (usable for an hour, and deleted as soon as the chosen domains are connected or the hour passes). scope is all of the account's domains or selected ones. The key is never returned.

Anyone whose role operates applications may connect a key, read the accounts and revoke one. Changing an account's access, scope or domains, connecting domains with it and replacing its key take an admin, an owner or the member who connected it (can_manage).