Single sign-on from WHMCS to cPanel, webmail and other panels

Customers expect to click one button in your client area and land in their control panel – no extra password. WHMCS supports single sign-on (SSO) through its server modules for cPanel/WHM, Plesk, DirectAdmin and Virtualizor. It also reduces password-reset tickets.

Before you start

• The server connected in WHMCS with an API token or credentials; see cPanel/WHM module or Virtualizor module.
• Services linked to that server with the correct username.

How it works

When a client clicks Log in to cPanel (or Webmail), WHMCS asks the server's API for a one-time login URL for that account and redirects the client. No password is stored in the browser, and the link expires within seconds.

Enable SSO for clients

1. Go to Configuration → System Settings → Servers and check the server's module supports SSO (cPanel shows SSO-related options).
2. In the cPanel module settings, allow client SSO and choose which shortcuts appear: cPanel, Webmail, File Manager, Email Accounts and so on.
3. For WHM API tokens, ensure the token's ACLs include creating user sessions (the create_user_session privilege comes with full reseller or root ACLs).
4. Save and open the client area as a test client to confirm the buttons.

Staff SSO

On a service page in the admin area, Login to cPanel or Login to WHM buttons let staff reach the account quickly. Restrict this with admin role permissions so only technical staff use it; see admin roles.

Client area shortcuts

The Twenty-One theme shows quick links on the service page (email accounts, file manager, backups, SSL status). Customise their order or hide items through the module settings or hooks; see hooks.

Security notes

• SSO is only as secure as the client's WHMCS login – encourage client two-factor authentication.
• Keep API tokens restricted to the WHMCS server's IP where possible.
• Log SSO use: WHMCS records SSO actions in the Activity Log.

Troubleshooting

• "Unable to create session" / 403: the API token lacks the session privilege, or the token belongs to a reseller who does not own the account.
• SSO lands on a login page: the server hostname in WHMCS does not match the certificate, or the session expired before redirect – check server time.
• Button missing: the service is suspended or not linked to a server with SSO support.

Next steps

• Manage client services.
• Client area theme.
• Security checklist.