| docs

Appearance

API Keys ​

The API Keys section allows administrators to create, view, edit, and manage secure API keys for authenticated system integrations. Each key can be restricted by IP address and toggled on or off individually.

API Keys Overview

Overview ​

URL: /admin/api-keys

At the top of the page, an Integration Overview box is displayed with a brief description of the API functionality and a link to the API documentation.

This page provides a searchable and paginated table of all existing API Keys.

Table Columns ​

  • Name - A user-defined name for the API Key (e.g., "my-integration").
  • API Key - The public token used for authentication.
  • API Secret - The private secret used alongside the key. This value is hidden by default.

Table Features ​

  • Search - You can search the list using any of the following fields:
    • Name
    • API Key
    • API Secret
  • Pagination - A dropdown at the bottom of the table allows you to select how many results to display:
    • 5, 10, 25, 50, or All results per page.

Actions ​

  • Create API Key - Opens a dedicated create page (/admin/api-keys/create).
  • Edit - Opens the edit modal for an existing key.
  • Delete - Permanently removes the selected key.

Create/Edit API Key ​

The modal form for creating or editing an API key is divided into two sections: API Key Details and Security Settings.

Create API Key Modal
Edit API Key Modal

API Key Details ​

  • Name* - A friendly label for the key.
  • API Key - Generated automatically and used for authentication.
  • API Secret - Also generated automatically.

Security Settings ​

  • API Key Enabled - Toggle to activate or deactivate the key.
  • Allow all endpoints - Toggle to allow access to every API route. When disabled, only selected endpoints and methods are allowed.
  • IP Restriction - Toggle to enable IP restriction.
    • Whitelisted IPs - A list of IP addresses from which requests will be accepted.
      • Format: Add one or more IPs using the input field.
  • Create - Saves the API Key and closes the modal.
  • Create & create another - Saves the key and reopens the form.
  • Save Changes - Updates the existing key.
  • Cancel - Closes the modal without saving.

Acting on behalf of a hosting account ​

An admin API key can call any /api/client/* endpoint on behalf of a hosting account, so an automation does not need a separate key per account. Name the account in the X-Hosting-Account header, using either its numeric id or its username:

bash
curl https://server.example:8443/api/client/domains \
  -H "X-API-Key: <your-key>" \
  -H "X-API-Secret: <your-secret>" \
  -H "X-Hosting-Account: alice"

Rules that apply:

  • The header is required. An admin key never acts on a client endpoint implicitly; without the header the request is refused, so a missing header can never be interpreted as "any account".
  • Endpoint ACLs apply as usual. A key restricted with Allow all endpoints turned off reaches only the client endpoints you selected.
  • A reseller key can only name accounts it owns. An account outside the reseller's own set is reported as not found, so a reseller cannot learn whether an account exists elsewhere on the server.

Every query the endpoint runs is scoped to the named account, exactly as it would be for that account's own key.