Restrict WHM API tokens by IP

An unrestricted API token is a permanent key to your whole reseller account. Bind it to the IP that uses it.

Limit a WHM API token so it only works from the address that needs it. Applies to reseller accounts and to any server with WHM.

Why it matters

An API token authenticates without a password and does not expire. Unrestricted, it works from anywhere.

If one leaks — committed to a repository, left in a backup, read from a compromised WHMCS installation — whoever has it can create, modify, suspend and terminate accounts, and reach client data. There is no second factor and nothing to notice.

A token restricted to your WHMCS server's IP address is useless to anyone who obtains it from anywhere else. It is a single field, and it converts a catastrophic leak into a non-event.

Restrict an existing token

Sign in to WHM.
Go to Development → Manage API Tokens.
Select the token, then Edit.
Enter the allowed IP address in the IP address restriction field.
Save.

Use the public IP of the machine that calls the API — your WHMCS server, not your own computer. Find it there with curl -s https://ifconfig.me.

Do this before anything depends on the token being unrestricted, and confirm the calling system still works immediately afterwards. If the address is wrong, provisioning stops — and the first sign is usually a customer order failing after payment.

While you are there

Grant only the privileges needed. A token for account provisioning does not need every permission WHM offers.

Remove tokens you no longer use. Old tokens for systems long since retired are still live keys.

Rotate after any exposure. If a token has been in a repository or a shared document, replace it rather than assuming nobody looked.

Check it worked

From the allowed machine, confirm your integration still functions — in WHMCS, Test Connection on the server entry.

From anywhere else, a request with that token should now be refused.

If provisioning breaks afterwards

The wrong IP. Use the calling server's public address, not the hostname it is reached by.
Its IP changed. A dynamic address means the restriction stops matching.
Multiple systems use the token. Restrict to all their addresses, or issue a separate token each — separate tokens are better, since one can be revoked alone.