# Restrict WHM API tokens by IP
Source: https://docs.webgee.com/en/reseller/enhancing-security-with-whm-api-token-ip-address-restrictions



Limit a WHM API token so it only works from the address that needs it. Applies to
reseller accounts and to any server with WHM.

## Why it matters [#why-it-matters]

An API token authenticates without a password and does not expire. Unrestricted,
it works **from anywhere**.

If one leaks — committed to a repository, left in a backup, read from a
compromised WHMCS installation — whoever has it can create, modify, suspend and
terminate accounts, and reach client data. There is no second factor and nothing
to notice.

<Callout type="warn">
  A token restricted to your WHMCS server's IP address is useless to anyone who
  obtains it from anywhere else. It is a single field, and it converts a
  catastrophic leak into a non-event.
</Callout>

## Restrict an existing token [#restrict-an-existing-token]

1. Sign in to **WHM**.
2. Go to **Development → Manage API Tokens**.
3. Select the token, then **Edit**.
4. Enter the allowed IP address in the **IP address restriction** field.
5. Save.

Use the public IP of the machine that calls the API — your WHMCS server, not your
own computer. Find it there with `curl -s https://ifconfig.me`.

<Callout type="warn">
  Do this **before** anything depends on the token being unrestricted, and
  confirm the calling system still works immediately afterwards. If the address
  is wrong, provisioning stops — and the first sign is usually a customer order
  failing after payment.
</Callout>

## While you are there [#while-you-are-there]

**Grant only the privileges needed.** A token for account provisioning does not
need every permission WHM offers.

**Remove tokens you no longer use.** Old tokens for systems long since retired
are still live keys.

**Rotate after any exposure.** If a token has been in a repository or a shared
document, replace it rather than assuming nobody looked.

## Check it worked [#check-it-worked]

From the allowed machine, confirm your integration still functions — in WHMCS,
**Test Connection** on the server entry.

From anywhere else, a request with that token should now be refused.

## If provisioning breaks afterwards [#if-provisioning-breaks-afterwards]

* **The wrong IP.** Use the calling server's public address, not the hostname
  it is reached by.
* **Its IP changed.** A dynamic address means the restriction stops matching.
* **Multiple systems use the token.** Restrict to all their addresses, or issue
  a separate token each — separate tokens are better, since one can be revoked
  alone.

## Related [#related]

* [Add a server to WHMCS](/en/reseller/how-to-add-a-server-or-reseller-account-into-your-whmcs)
* [Enable SSH for a customer's account](/en/reseller/is-ssh-enabled-for-a-reseller-account)