| docs

Appearance

API Keys ​

An API key lets an external application authenticate against the panel's REST API. Each key can be turned off, limited to a set of endpoints, and limited to a set of source addresses.

API Keys

Overview ​

URL: /admin/settings/api-keys

Open it from Settings > Security > API Keys in the sidebar. The entry carries a counter showing how many keys exist, and a fresh server has none, so the list opens on No API Keys.

An Integration Overview box at the top of the page links to the API documentation served by this server.

The key list ​

ColumnMeaning
NameThe label you gave the key.
API KeyThe public token sent with each request.
API SecretThe private counterpart. Hidden by default.

The search box covers all three columns, and the page size can be set to 5, 10, 25, 50, or All. Each row offers Edit and Delete; deleting a key stops every integration using it, immediately.

Creating a key ​

Create API Key opens Create API Key at /admin/settings/api-keys/create.

Create API Key

The form is grouped into three sections:

API Key Details ​

  • Name (required) - a descriptive name that identifies the integration.
  • API Key and API Secret - both read Generated automatically. You do not choose them, and the secret is shown to you only once the key is created, so store it before you leave the page.

Security Settings ​

  • Enable API Key - whether the key can be used at all. Turning it off is the quickest way to suspend an integration without deleting its key.
  • IP Restriction - limits the key to the source addresses you list.

Endpoint Access ​

  • Allow all endpoints - when on, the key reaches every API route. When off, only the endpoints and methods you select are allowed.

Create saves the key, Create & create another reopens an empty form, and Cancel returns to the list.

Editing a key ​

Edit on a row reopens the same three sections with the current values, so you can rename a key, disable it, tighten its endpoint list, or change its address restriction. Save Changes applies the change. The secret is not shown again; issue a new key if it has been lost.

Acting on behalf of a hosting account ​

An admin API key can call any /api/client/* endpoint on behalf of a hosting account, so an automation does not need a separate key per account. Name the account in the X-Hosting-Account header, using either its numeric id or its username:

bash
curl https://server.example:8443/api/client/domains \
  -H "X-API-Key: <your-key>" \
  -H "X-API-Secret: <your-secret>" \
  -H "X-Hosting-Account: alice"

Rules that apply:

  • The header is required. An admin key never acts on a client endpoint implicitly; without the header the request is refused, so a missing header can never be interpreted as "any account".
  • Endpoint ACLs apply as usual. A key with Allow all endpoints turned off reaches only the client endpoints you selected.
  • A reseller key can only name accounts it owns. An account outside the reseller's own set is reported as not found, so a reseller cannot learn whether an account exists elsewhere on the server.

Every query the endpoint runs is scoped to the named account, exactly as it would be for that account's own key.