API tokens allow external applications or scripts to securely interact with your cPanel account without exposing your login credentials. By generating and managing API tokens, you can grant access to specific functions or tools as needed. This guide explains how to create, manage, and revoke API tokens in cPanel.

What Are API Tokens?

An API token is a unique string used to authenticate requests to the cPanel API. It provides an alternative to using your cPanel username and password for automated or remote tasks. API tokens are commonly used for:

• Integrating with external systems like backup tools or billing platforms.

• Automating website management through scripts.

• Accessing specific cPanel functions via API calls.

How to Create an API Token in cPanel

1. Log in to cPanel

• Open your browser and go to your cPanel login page, for example: https://yourdomain.com/cpanel.

• Enter your username and password.

• Click Log in.

2. Access the API Tokens Tool

• In the cPanel dashboard, go to the Security section.

• Click Manage API Tokens.

3. Generate a New API Token

• On the API Tokens page, click Generate New Token.

• Enter a name for the token to describe its purpose, such as Backup Script Access.

• Select the specific permissions the token should have. Permissions control what the token is allowed to do.

• For security, grant only the minimum permissions needed.

• Click Generate Token.

4. Copy the API Token

• After the token is generated, copy it and store it in a secure location.

• You will not be able to view the token again after leaving the page.

• Use this token in scripts or applications to authenticate with the cPanel API.

How to View, Manage, and Revoke API Tokens

View Existing API Tokens

• On the API Tokens page, you will see a list of all tokens that have been created.

• Each token entry shows its name and the permissions assigned.

Edit API Token Permissions

• To change the permissions of a token, click Edit next to the token.

• Adjust the permissions and click Save.

Revoke an API Token

• To disable or delete a token, click Revoke next to it.

• Once revoked, the token will no longer work for API access.

Security Considerations

• Limit token permissions to only what is required.

• Store API tokens securely, as you would with passwords.

• Revoke any tokens that are no longer needed or that may have been exposed.

Use Case Examples for API Tokens

• Automating backups: Use a token with backup permissions to run scheduled backup scripts.

• Connecting third-party services: Allow secure communication with services like CDNs or cloud storage using tokens.

• Email management: Use a token to automate email account creation or manage filters through an external tool.