Create cPanel API tokens to automate your hosting account

cPanel has an API (called UAPI) that can do almost everything the interface does: create mailboxes, edit DNS, list databases, start backups. Scripts and integrations authenticate with an API token instead of your password, so you can give an integration access and revoke it later without changing your login.

Before you start

• Basic command-line or scripting knowledge.
• Treat a token like a password: anyone with it can control your account through the API.

Create a token

1. Open cPanel → Security → Manage API Tokens.
2. Click Create.
3. Enter a Name describing its use, e.g. dns-updater.
4. Set an expiration date where possible, or choose that it does not expire only for long-term integrations you control.
5. Click Create. cPanel shows the token once. Copy it to your password manager or secret store immediately.

Call the API

UAPI requests go to your cPanel address on port 2083 with the header Authorization: cpanel USERNAME:TOKEN. Examples with curl:

List email accounts:

curl -s -H "Authorization: cpanel cpuser:YOUR_TOKEN" "https://example.com:2083/execute/Email/list_pops"

Create a mailbox with a 1 GB quota:

curl -s -H "Authorization: cpanel cpuser:YOUR_TOKEN" "https://example.com:2083/execute/Email/add_pop?email=info&domain=example.com&password=Str0ng-Pass-123&quota=1024"

List MySQL databases:

curl -s -H "Authorization: cpanel cpuser:YOUR_TOKEN" "https://example.com:2083/execute/Mysql/list_databases"

Responses are JSON with status (1 = success), data and errors. The full list of modules and functions is in the official cPanel UAPI documentation.

Good practice

• One token per integration, with a clear name, so you can revoke one without breaking others.
• Use the server hostname in the URL if your domain's certificate is not yet issued.
• Send parameters by POST in scripts that create passwords, so secrets do not end up in logs.
• Store tokens in environment variables, not in code.

Revoke or rename

In Manage API Tokens, select a token and click Revoke. Integrations using it stop working immediately. Review the list regularly and remove tokens you no longer recognise.

Troubleshooting

• 401 / Access denied: wrong username, revoked or expired token, or typo in the header format (cpanel user:token).
• Connection timed out: port 2083 is blocked from where the script runs, or the IP was blocked by the firewall after failed attempts; contact support.
• Function not found: the feature is disabled for your account, or the module/function name is misspelled.

Next steps

• Protect your login with 2FA
• Dynamic DNS without the API
• API tokens for WHM resellers