Create VirtFusion API tokens and make your first API call

The VirtFusion API lets WHMCS, scripts and your own tools create and manage servers without the web panel. Every request is authenticated with an API token sent as a Bearer header, so creating and protecting tokens is the first step.

Before you start

• Admin access to the VirtFusion admin area.
• Your panel URL, for example https://cp.example.com.
• A machine with curl (and optionally jq to format JSON).

Create a VirtFusion API token

1. In the admin area open the API section (under settings or your account menu, depending on version).
2. Create a new token and give it a descriptive name, such as whmcs-production or monitoring-script.
3. Copy the token immediately. It is usually shown only once.
4. Store it in a password manager or secrets store, never in a public repository.

Make your first API call

List servers with curl (replace the URL and token):

curl -s -H "Authorization: Bearer YOUR_TOKEN" -H "Accept: application/json" https://cp.example.com/api/v1/servers | jq .

A JSON response with your servers means the token works. A 401 means the token is wrong or revoked. The full list of endpoints (servers, users, packages, hypervisors, IP blocks) is in the VirtFusion API documentation.

Use the token in WHMCS

1. In WHMCS open System Settings → Servers and edit the VirtFusion server.
2. Paste the token into the password or access hash field the module expects.
3. Use Test Connection to confirm.

See VirtFusion WHMCS module setup for the full configuration.

Keep tokens safe

• Use one token per integration so you can revoke one without breaking the others.
• Restrict API access to known IPs with the control server firewall where possible.
• Rotate tokens when staff leave or if a token might have leaked.
• Always call the API over HTTPS.

Troubleshooting

• 401 Unauthenticated: check for spaces copied with the token and that the header is exactly Authorization: Bearer ….
• HTML instead of JSON: add the Accept: application/json header and check the URL path.
• SSL errors: the panel certificate is invalid or expired; fix it rather than disabling verification.

Frequently asked questions

Can I limit what a token can do?

Check your version's token options. If scoping is not available, compensate with IP restrictions and separate tokens.

Does the API support creating servers?

Yes. WHMCS uses the same API to create, suspend, resize and delete servers.

Is there rate limiting?

Avoid tight loops; batch work and add short delays in scripts.

Next steps

• WHMCS module setup
• Fix WHMCS provisioning errors
• WHMCS API credentials and roles