Use Blesta's Add registrar account or Edit registrar account form to connect the installed module. The current form supports the standard API username/email and API key, with advanced one-time bootstrap or HMAC key ID and secret options.
IN THIS ARTICLE
01 Select one authentication method
| Method | Fields | Preparation |
|---|---|---|
| Standard API key | API username / email and API key. | Issue the credential in the reseller API Access workflow. |
| Advanced bootstrap | Advanced one-time bootstrap token. | Obtain a valid token for this installation; leave email authentication unselected. |
| Advanced HMAC | Key ID and API secret. | Issue a permitted HMAC identity and leave email authentication unselected. |
02 Test and save the account
- Enter a recognisable Account name and the final HTTPS API endpoint URL.
- Complete the fields for the selected authentication method. Do not paste a bootstrap token into the normal API-key field.
- Click Test and save account. The connector checks the upstream profile before retaining the account configuration.
- Check that the returned account is the intended reseller and that web and scheduled traffic use permitted source addresses.
- Configure TLD assignment and annual pricing separately after the connection is correct.
03 Edit or rotate safely
On an unchanged endpoint, the edit form allows blank key fields to retain stored credentials. Secrets are encrypted in module-row metadata and are not displayed again. To rotate, enter the newly issued credential, save and verify access before retiring any overlapping old key according to the upstream workflow.
Changing the endpoint requires newly entered credentials. The connector refuses to send an existing saved key automatically to a different URL. For bootstrap, the token is consumed once and exchanged for the installation's credential pair.
Common questions
Why does an old bootstrap token fail?
It may have expired or already been consumed. Check whether the original account save succeeded before requesting a replacement.
Does removing the module account revoke the upstream key?
No. Local removal does not delete registered domains or revoke a credential another installation might use. Manage upstream keys explicitly.
Can I expose the saved secret to diagnose access?
Use the test result, key metadata and redacted error reference. Do not export encrypted settings or reveal secrets in a support ticket.