Billing systems, monitoring tools and scripts need to talk to WHM. Instead of giving them your password, create an API token: a long secret that works only for the API, can be limited to certain actions and can be revoked at any time without changing your password.
Before you start
- WHM access on your reseller plan.
- The tool that needs access and the actions it must perform, for example creating and suspending accounts.
Create a token
- Log in to WHM.
- Go to WHM → Development → Manage API Tokens.
- Click Generate Token.
- Enter a Token Name that says where it is used, such as
whmcs-billing. - Under Privileges, either keep Everything or select only what the tool needs. For WHMCS, account creation, modification, suspension, termination, package listing and DNS are typical.
- Optional: set an Expiration date.
- Click Save.
- Copy the token immediately. WHM shows it only once.
Warning: Treat a token like a password. Anyone with it can manage all your customer accounts within its privileges. Never paste it into tickets, chats or public code repositories.
Use the token
Tools ask for the server hostname, your WHM username and the token. API requests send it in an HTTP header:
Authorization: whm youruser:YOURTOKENFor a quick test from a terminal:
curl -H "Authorization: whm youruser:YOURTOKEN" "https://server-hostname:2087/json-api/listaccts?api.version=1"A JSON list of your accounts means the token works. For WHMCS setup, see selling hosting with WHMCS.
Rotate tokens
- Generate a new token with the same privileges.
- Update the tool to use it and test.
- Revoke the old token.
Rotating once or twice a year, and whenever staff with access leave, limits the damage of an unnoticed leak.
Revoke a token
- Go to WHM → Development → Manage API Tokens.
- Find the token by name and click Revoke, then confirm.
Requests using it fail at once. If you think a token leaked, revoke it first, then check List Accounts for accounts you did not create.
Troubleshooting
"Access denied" or HTTP 403
The token lacks a privilege for that call, the username is wrong, or the token was revoked or expired.
Connection refused
The tool connects to port 2086 or a wrong hostname. Use HTTPS on port 2087 with the server hostname.
Frequently asked questions
Can customers create API tokens too?
Yes, cPanel users can create cPanel API tokens in cPanel → Security → Manage API Tokens for their own account only.
Does changing my password break tokens?
No. Tokens are independent of your password, which is one of their advantages.
How many tokens can I have?
Create one per tool or integration so you can revoke them separately.
Can I limit a token to certain IP addresses?
WHM tokens are limited by privileges and expiry. Protect them by storing them only on trusted servers, and revoke them if a server is compromised.
What happens to a token when it expires?
Requests with it are refused. Set a calendar reminder to rotate tokens before their expiry date so integrations do not break.