Rotating a WHM integration token with minimal interruption

Inventory the integration’s API functions, current token owner and fixed outbound IPs. Confirm who can update its protected configuration and identify a harmless test operation.

1. Open Manage API Tokens in WHM and generate a uniquely named replacement token.
2. Set an appropriate expiry and restrict caller IPs where stable addresses are available. Select only the ACL privileges the integration actually needs.
3. Review broad privileges carefully. Everything, password-changing, session-creation and token-management capabilities can confer much greater access than their names suggest.
4. Copy the displayed token immediately into the integration’s secure secret store. Update the authorised integration and test its required operations against a controlled account.
5. Revoke the old token after the replacement passes, then confirm the integration still works. Record expiry, owner and renewal responsibility.

The integration should use the new token successfully and the retired token should no longer authenticate. Logs and support screenshots must not reveal either secret.

If the replacement is denied, inspect its owner, caller IP and required ACLs. Do not grant Everything just to eliminate an unexplained permission error. WHM documents token ACL restrictions with limitations, so review the installed version and privileged combinations carefully.

The complete value is shown during creation and should be saved securely then. If it is lost, create a controlled replacement rather than trying to extract it from public logs or insecure backups.

• Revoking an exposed WHM API token and auditing its use
• Creating a cPanel API token for an authorised integration
• Enabling two-factor authentication for WHM administration
• Changing an account bandwidth allowance in WHM

• cPanel: Manage API Tokens In Whm
• cPanel: Edit Reseller Nameservers And Privileges