API Keys

URL: /client/api-keys

Location in Sidebar: Security > API Keys

Generate and manage personal API keys to access the AdminBolt API programmatically.

Overview

The API Keys interface lets you create authentication tokens for the AdminBolt API. Each key can be used by scripts, automation tools, or third-party applications to perform actions on your behalf without sharing your panel password.

For detailed documentation, visit docs.adminbolt.com.

Create API Key

Click the New API Key button to open the create form (/client/api-keys/create). The form includes:

API Key Details

• Key Name (text, required) - A friendly identifier used to recognize the key later (e.g., Deployment script, Backup tool).

Security Settings

• Enable API Key (toggle, on by default) - A disabled key is refused.
• IP Restriction (toggle, off by default) - When on, Whitelisted IPs limits the key to the addresses you list.

Endpoint Access

• Allow all endpoints (toggle, on by default) - When off, Allowed endpoints lists the endpoints and methods the key may call.
• Allow WP-CLI execution (toggle, off by default) - Lets the key run WP-CLI on the account's WordPress sites. Leave it off unless a tool needs it.

Form buttons: Create, Create & create another, Cancel

After the key is created, the secret token is shown once. Copy and store it securely - for security reasons it cannot be retrieved again from the panel.

Find Keys

Use the search bar to quickly locate keys by name.

Key Management

When API keys exist, the table lists them with the following information:

• Name - The key's friendly identifier.
• Created - Timestamp of key creation.
• Last Used - Most recent time the key was used to authenticate an API request.
• Actions - Revoke / delete the key.

Empty State

If no API keys have been created, the interface displays No API Keys to indicate the empty state.

What a key can reach

Since panel 1.9.4, the client API follows the same rules as the client panel. A key reaches what your hosting account can open in the panel, and nothing more. These rules apply before the endpoint runs, to every client API endpoint, including the mailing list endpoints under /api/mailing-lists.

Your hosting plan

Each endpoint belongs to a feature of your hosting plan's Feature List, the same feature that shows or hides the matching page in the client panel. When your plan leaves that feature out, the endpoint is refused, for reading as well as for changes, with HTTP 403:

{
  "error": "This feature is not included in the hosting plan",
  "message": "This feature is not included in your hosting plan.",
  "feature": "databases"
}

message is in the panel's language and can be shown to people as it is. feature names the plan feature the endpoint belongs to. Ask your hosting provider to add the feature to your plan if you need it.

A few endpoints belong to no plan feature and stay available: your account details, the service status of your server, and the file manager.

Keys of your hosting provider's administrator or reseller that act on your account meet the same plan.

Cron jobs

As on the Cron Jobs page, the cron job endpoints are refused while your account has no SSH access ("reason": "ssh_access_disabled") or while the server cannot run cron jobs for hosting accounts ("reason": "cron_unavailable_on_server").

While the account is suspended

Since panel 1.9.4, while your hosting account is suspended its own API keys are refused on every request, reading included, with HTTP 403:

{
  "error": "The hosting account is suspended. Please contact your hosting provider.",
  "message": "Your account has been suspended. Please contact your hosting provider.",
  "reason": "account_suspended"
}

The keys work again on the next request after the account is unsuspended. In panel 1.9.3 a suspended account's keys could still read.

Keys of your hosting provider's administrator or reseller that act on your account are not affected, so your provider can still manage the account.

Service status

GET /api/client/services returns the services of the server your account is on, with their health status and whether each is installed. Since panel 1.9.4 it reports only that server: the optional server_id takes only 0, and any other value is refused with HTTP 403.

Use a key with AI clients (MCP)

An API key also connects AI clients such as Claude, Cursor, or VS Code to your account over the Model Context Protocol. The steps, and what the assistant can do with the key, are in MCP Server: Connecting as a hosting account.

Security Tips

• Treat API keys like passwords - never commit them to public repositories.
• Use a separate key for each application or environment so you can revoke them independently.
• Revoke any key that may have been exposed and create a new one.

Getting Started

Create your first API key by clicking the New API Key button, giving it a recognizable name, and storing the generated token in a secure location.