Rotate Domain Nexus API credentials across web and scheduled integrations

The email/API-key workflow and advanced HMAC applications are different. The WHMCS and HostBill connectors use email/API-key authentication. Blesta and FOSSBilling support that standard method as well as advanced HMAC credentials; Blesta also has its documented bootstrap option. Rotate through the workflow matching the credential you actually deployed.

1. List all installations, workers and scripts using the credential.
2. Review its scopes, source-network restrictions, expiry and account status.
3. Create or rotate the replacement through the account's supported API Access or advanced key controls.
4. Save the newly revealed secret in the intended secure storage.
5. Update one controlled consumer and make a read-only profile or owned-domain request.

For a saved connector credential, update the correct module account. For an environment-held secret, update both web PHP and scheduled workers. Reload the relevant processes under your server's normal procedure. A successful test from your SSH shell does not prove PHP-FPM or cron received the new value.

Check allowed outgoing IPv4 and IPv6 addresses for each consumer. A credential can work in the web interface and fail during cron if the two processes use different network paths.

The standard email/API-key rotation replaces the existing secret immediately. Coordinate the consumer update instead of assuming an overlap period. Advanced HMAC rotation provisions a new key and returns overlap_ends_at for the retiring key. Use that actual deadline, verify the replacement across all consumers and revoke the old key when appropriate. For an exposed credential, handle revocation according to the incident's urgency.

Advanced API routes support creating keys, rotating an owned key, replacing scopes or networks and revoking a key under its application. These are permissioned mutations and require the current route's idempotency handling.

A secret shown once is not generally recoverable by rereading the application's metadata. Issue a replacement through the supported workflow instead of searching logs for a copy. Do not place a new secret in a ticket, repository or generated connector ZIP.

Record the rotation time and affected consumers using a masked key identifier. If an integration fails afterward, compare the credential type, exact endpoint, account identity, network policy and process environment before changing unrelated DNS provider tokens.

• Get started with the current Nabtech Domain Nexus v2 API
• Sign Domain Nexus v2 API requests with HMAC authentication
• Install the current Nabtech Domain Nexus registrar connector in WHMCS
• Install the current Nabtech Domain Nexus connector in HostBill
• Install the Nabtech Domain Nexus registrar adapter in FOSSBilling