KoaPanel
IT Try it free
All manual sections

DocumentationWHMCS and API keys

WHMCS and API keys

KoaPanel connects to WHMCS (8.x and 9.x) with the official module: when a customer orders hosting, WHMCS creates the account on the panel, suspends it when an invoice is unpaid, upgrades and deletes it, and the customer signs in to the panel with one click from the WHMCS client area.

API keys

WHMCS and other billing systems use a personal API key. Create it in API keys (administrators and resellers):

  • the key (kpk_…) is shown once: copy it right away;
  • it acts as you: a reseller's key reaches only the reseller's accounts and packages, within its quota; creating resellers from WHMCS needs an administrator key;
  • keys are created and deleted only while logged into the panel (a key cannot create keys);
  • at most 300 requests per minute and 10 keys per account;
  • if the account is suspended or deleted, its keys stop working;
  • in the Activity log everything done with a key shows "via API key …" and the system that used it.

Delete at once a key you no longer use or that may have been seen by others.

Connecting WHMCS

  1. Download the module from https://console.koapanel.app/updates/integrations/ and extract it in the WHMCS folder (modules/servers/koapanel).
  2. In WHMCS add a server: Hostname = this panel's name, Module KoaPanel, Password = the API key, Secure yes, port 8443. Press Test Connection.
  3. Create products with the KoaPanel module: pick a panel package or set the limits (sites, disk, databases, mailboxes); for a reseller product choose "Reseller" and the number of accounts.

The full WHMCS guide is README.en.md in the module zip.

What WHMCS does on the panel

  • Creates the account with the service username and password (a strong password is generated when WHMCS's is too weak); creating again does not make duplicates.
  • Suspends and unsuspends the account, with the reason written in WHMCS.
  • Changes the package or the reseller quota.
  • Deletes the account and its sites when the service is terminated.
  • One-click sign-in: WHMCS asks the panel for a one-time sign-in link valid 60 seconds; the client area also has direct links to Files, WordPress, Email and Databases. A suspended account gets no link.
  • Once a day it reads the disk used by each account.

Reselling KoaPanel licenses

Partner providers can also sell KoaPanel licenses from WHMCS with the koapanel_license module and the partner key issued by KoaPanel.

Blesta and FOSSBilling

Besides WHMCS there are official modules for Blesta and FOSSBilling, with the same functions (create, suspend, change plan, change password, delete, one-click sign-in, resellers). Download them for free from https://console.koapanel.app/updates/integrations/ (koapanel-blesta-latest.zip, koapanel-fossbilling-latest.zip) and connect them with an API key, like WHMCS; the instructions are in each module's README. For other systems use the API.

Connecting KoaBilling at install time

Whoever installs the panel can choose its name and get the KoaBilling details right away:

curl -fsSL https://get.koapanel.app | sudo bash -s -- \
  --hostname panel.mydomain.com --email you@mydomain.com --koabilling
  • --hostname is the name of the panel: the Let's Encrypt certificate arrives by itself if the name already points to the server and port 80 is open. If not yet, the panel keeps trying and the installation finishes anyway.
  • --email is the address for Let's Encrypt.
  • --koabilling creates an API key of the administrator. At the end the installation shows the address and the key: paste them in KoaBilling, in the KoaPanel provider. The key is visible only at that moment and in /root/koapanel-install.log, readable by root only: save it, then delete the file.
  • --license activates the license. Without a license, a new panel answers (the key included) only after the account is linked in Plan and license.

As root on the server you can also create a key later: panel-agent apikey create --user admin --label KoaBilling. Keys created this way are listed and deleted in API keys like the others.