diff --git a/acme.sh b/acme.sh
index 6a600087a4..0f51002126 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2229,7 +2229,41 @@ _readaccountconf_mutable() {
 _clearaccountconf() {
   _clear_conf "$ACCOUNT_CONF_PATH" "$1"
 }
-
+#_readdnsapiconf key
+_readdnsapiconf() {
+  local acctmutcnf=$(_readaccountconf_mutable $1)
+  local acctcnf=$(_readaccountconf $1)
+  local domcnf=$(_readdomainconf "SAVED_$1")
+  if [ -n "$domcnf" ]; then
+    dnsapi_auth_conf_loc=domainconf
+    echo -ne "$domcnf"
+  elif [ -n "$acctmutcnf" ]; then
+    dnsapi_auth_conf_loc=accountconf_mutable
+    echo -ne "$acctmutcnf"
+  elif [ -n "$acctcnf" ]; then
+    dnsapi_auth_conf_loc=accountconf
+    echo -ne "$acctcnf"
+  else 
+    return 1
+  fi
+  _debug "Read dnsapi conf <$1> from ${dnsapi_auth_conf_loc}"
+}
+#_savednsapiconf key value base64encode
+_savednsapiconf() {
+  _readdnsapiconf $1 >/dev/null
+  #update the original save location if existed for backward compat
+  case "${dnsapi_auth_conf_loc}" in 
+  accountconf_mutable)
+    _saveaccountconf_mutable $1 "$2" $3
+  ;;
+  accountconf)
+    _saveaccountconf $1 "$2" $3
+  ;;
+  esac
+  #we'll use this value on automation
+  _savedomainconf "SAVED_$1" "$2" $3
+  unset dnsapi_auth_conf_loc
+}
 #_savecaconf  key  value
 _savecaconf() {
   _save_conf "$CA_CONF" "$1" "$2"
diff --git a/dnsapi/dns_cf.sh b/dnsapi/dns_cf.sh
index 36799dcd9a..d17c86be6a 100755
--- a/dnsapi/dns_cf.sh
+++ b/dnsapi/dns_cf.sh
@@ -18,16 +18,16 @@ dns_cf_add() {
   fulldomain=$1
   txtvalue=$2
 
-  CF_Token="${CF_Token:-$(_readaccountconf_mutable CF_Token)}"
-  CF_Account_ID="${CF_Account_ID:-$(_readaccountconf_mutable CF_Account_ID)}"
-  CF_Zone_ID="${CF_Zone_ID:-$(_readaccountconf_mutable CF_Zone_ID)}"
-  CF_Key="${CF_Key:-$(_readaccountconf_mutable CF_Key)}"
-  CF_Email="${CF_Email:-$(_readaccountconf_mutable CF_Email)}"
+  CF_Token="${CF_Token:-$(_readdnsapiconf CF_Token)}"
+  CF_Account_ID="${CF_Account_ID:-$(_readdnsapiconf CF_Account_ID)}"
+  CF_Zone_ID="${CF_Zone_ID:-$(_readdnsapiconf CF_Zone_ID)}"
+  CF_Key="${CF_Key:-$(_readdnsapiconf CF_Key)}"
+  CF_Email="${CF_Email:-$(_readdnsapiconf CF_Email)}"
 
   if [ "$CF_Token" ]; then
-    _saveaccountconf_mutable CF_Token "$CF_Token"
-    _saveaccountconf_mutable CF_Account_ID "$CF_Account_ID"
-    _saveaccountconf_mutable CF_Zone_ID "$CF_Zone_ID"
+    _savednsapiconf CF_Token "$CF_Token"
+    _savednsapiconf CF_Account_ID "$CF_Account_ID"
+    _savednsapiconf CF_Zone_ID "$CF_Zone_ID"
   else
     if [ -z "$CF_Key" ] || [ -z "$CF_Email" ]; then
       CF_Key=""
@@ -43,8 +43,8 @@ dns_cf_add() {
       return 1
     fi
     #save the api key and email to the account conf file.
-    _saveaccountconf_mutable CF_Key "$CF_Key"
-    _saveaccountconf_mutable CF_Email "$CF_Email"
+    _savednsapiconf CF_Key "$CF_Key"
+    _savednsapiconf CF_Email "$CF_Email"
   fi
 
   _debug "First detect the root zone"
@@ -92,11 +92,11 @@ dns_cf_rm() {
   fulldomain=$1
   txtvalue=$2
 
-  CF_Token="${CF_Token:-$(_readaccountconf_mutable CF_Token)}"
-  CF_Account_ID="${CF_Account_ID:-$(_readaccountconf_mutable CF_Account_ID)}"
-  CF_Zone_ID="${CF_Zone_ID:-$(_readaccountconf_mutable CF_Zone_ID)}"
-  CF_Key="${CF_Key:-$(_readaccountconf_mutable CF_Key)}"
-  CF_Email="${CF_Email:-$(_readaccountconf_mutable CF_Email)}"
+  CF_Token="${CF_Token:-$(_readdnsapiconf CF_Token)}"
+  CF_Account_ID="${CF_Account_ID:-$(_readdnsapiconf CF_Account_ID)}"
+  CF_Zone_ID="${CF_Zone_ID:-$(_readdnsapiconf CF_Zone_ID)}"
+  CF_Key="${CF_Key:-$(_readdnsapiconf CF_Key)}"
+  CF_Email="${CF_Email:-$(_readdnsapiconf CF_Email)}"
 
   _debug "First detect the root zone"
   if ! _get_root "$fulldomain"; then