The Virtualizor admin API exposes almost everything in the admin panel, from listing VPSs to creating and suspending them. WHMCS uses it to provision servers, and you can use it for your own scripts. This guide covers the admin side; customers have a separate end-user API.
Before you start
- Root admin access to the Virtualizor master panel.
- The IP addresses of the machines that will call the API (your WHMCS server, your scripts).
- A machine with
curl.
Create Virtualizor admin API credentials
- In the admin panel go to Configuration → API Credentials (the location may differ slightly by version).
- Create a new key. Virtualizor generates an API key and an API pass.
- Add the allowed IP addresses so only your servers can use the key.
- Save both values in a password manager.
Warning: Admin API credentials can create and delete any VPS. Always limit them by IP and never paste them in tickets or public code.
Make a first call
The admin API listens on the admin panel port (HTTPS 4085 by default) and takes the action in the act parameter. List VPSs as JSON:
curl -sk "https://MASTER_IP:4085/index.php?act=vs&api=json&adminapikey=API_KEY&adminapipass=API_PASS"A JSON response with a vs list means the credentials work. Other actions, such as adding, suspending and rebuilding VPSs, are listed in the official Virtualizor API documentation with their parameters. Virtualizor also provides a PHP SDK class that wraps these calls.
Note: -k skips certificate checks for a self-signed panel certificate. Install a valid certificate on the panel and drop -k in production.
Use the credentials in WHMCS
- WHMCS → System Settings → Servers, edit the Virtualizor server.
- Enter the master IP or hostname, put the API key in the username field and the API pass in the password field (as the module documents), and test the connection.
Full setup: Virtualizor WHMCS module.
Troubleshooting
- Empty or HTML response: wrong port or path, or
api=jsonmissing. - Authentication failed: the calling IP is not in the allowed list, or key and pass are swapped.
- Connection refused: port 4085 blocked by the master's firewall.
Frequently asked questions
Can I have several API keys?
Yes. Use one per integration so you can revoke one without breaking others.
Is the API the same as the WHMCS module?
The module is a client of the admin API.
Can resellers use the admin API?
Resellers have their own limited access; check the reseller and ACL settings (users, resellers and ACL).