Create separate WHMCS API credentials for each integration and grant only its required API actions. This makes access easier to review, rotate and revoke without distributing a staff member's normal login password.
IN THIS ARTICLE
01 Create the role and credential
- Obtain the integration's documented list of API operations and identify its responsible owner.
- Open System Settings and Manage API Credentials, then the API Roles tab.
- Create an API role with a meaningful name and select only the required actions.
- Open API Credentials and choose Generate New API Credential.
- Select the intended administrator identity, enter an integration-specific description and assign the required API role.
- Generate the identifier and secret, store them in the approved secret location and configure the integration securely.
- In an isolated test installation, test a harmless permitted read request and a harmless read action excluded by the test role. Do not use a write, refund, suspension or termination action as a permission test.
02 Maintain integration ownership
Record where the credential is used, the source system, allowed actions and rotation procedure. Keep it out of browser-side code, public repositories, screenshots and support attachments. An integration that only reads service data should not receive unrelated termination or refund capabilities.
Multiple roles combine their permitted API actions. Review the complete role set when diagnosing unexpected access rather than examining only one role.
03 Check the remote integration source address as well as its API role
An API role determines permitted actions, while the remote integration must also satisfy the installation's API access policy. For an off-server integration, review General Settings > Security > API IP Access Restriction.
Obtain the integration server's actual outbound public address from its administrator. For example, a documentation address such as 198.51.100.27 illustrates the type of value, but must be replaced with the verified address used by your integration. The customer's laptop address is not necessarily the source of the server-side API call.
Expected result: the intended integration connects from its approved location and still has only the actions assigned to its credential. If the source address changes during a server migration, update the reviewed restriction and retest. Do not grant additional API actions merely to investigate a source-address rejection.
Common questions
Why does a valid identifier still receive permission errors?
Credentials need assigned API roles with the required actions. A credential without an effective permission set is not authorised to perform requests.
Does changing an administrator password revoke API credentials?
No. Review and remove the relevant credential pair explicitly. Disabling or deleting the associated administrator invalidates its associated API credentials.
Can a lost API secret be displayed again?
Follow the documented replacement process: generate a new pair, update and test the integration, then revoke the obsolete pair.
After rotation, verify both scheduled and interactive calls so an overlooked background job does not fail later.