API credentials and IPs

Permissions and prerequisites

The tenant owner or an administrator with API permission manages tokens. Provisioning and changing WHMCS reseller services requires a tenant administrator with full permissions.

1. Sign in as the tenant owner or an administrator with API permission.
2. For WHMCS provisioning and service changes, use a token owned by a tenant administrator with full permissions.
3. Determine the actual outbound public IP of your WHMCS server.

Create the token

1. Open Customer portal → API.
2. Enter one allowed outbound IP or CIDR per line; a /0 network is rejected.
3. Generate the token and securely copy the value shown once.
4. In WHMCS, open Addons → MailOcean → API connection, save the token and test the connection.

Protect access

Treat the token like a password and allow only necessary server IPs. Each API request uses HTTPS and Authorization: Bearer <token>.

1. Keep the token only in your authorized WHMCS environment and use HTTPS and Bearer authorization for requests.
2. Update the allowlist and retest when the outbound IP changes.
3. If exposure is suspected, rotate the token and update WHMCS; the old token stops working immediately.