Creating a cPanel API token for an authorised integration

Confirm the integration uses the cPanel API rather than WHM and supports token authentication. Review the required operations and the account’s available permissions. Do not put tokens in browser JavaScript, a public repository or a URL query string.

1. Open Manage API Tokens in cPanel and choose Create. Give the token a unique name identifying the integration and purpose.
2. Select an appropriate expiry date when available and record the renewal owner. The current interface does not allow changing an existing token’s expiry after creation.
3. Create the token and copy it immediately into the integration’s protected secret store. The full value is not available again after leaving the creation screen.
4. Configure the integration to use HTTPS and the vendor’s documented authentication format. Test a read-only operation first, then the smallest necessary authorised action.
5. Review the token list periodically. Rotate by installing and testing a replacement before revoking the retired token, and remove expired entries from the list.

The intended integration should authenticate against the correct server and account. Check that logs redact the token and that the application does not expose it to ordinary visitors.

If a token is lost or exposed, revoke it and create a replacement. Renaming does not rotate its secret. If a call is denied, verify the endpoint and account permissions instead of using the owner password as an undocumented fallback.

No. WHM and cPanel authenticate different APIs and operate at different administrative scopes. Use the token type required by the integration, and do not assume WHM ACL controls are present on a cPanel token screen.

• Enabling two-factor authentication for a cPanel login
• Revoking a departing team member’s cPanel access
• Rotating a WHM integration token with minimal interruption
• Changing or recovering your cPanel password

• cPanel: Manage API Tokens In cPanel