Billing integrations

#How it works

The module in your billing system connects to the panel's billing API over HTTPS and manages accounts by username. Every call uses the token you create for the billing system and is recorded in the panel's Sync and activity log. The token only works on the billing endpoints; it cannot open a normal panel session or use the general API, and it acts with the permissions of the administrator or reseller who created it.

The page lives under Server Admin → Billing Integrations and has four tabs:

The feature is the same in the Community and Pro editions. Because the Community edition allows at most 3 hosting accounts, a create request is rejected with an error message once the limit is reached, and selling reseller accounts requires the Pro edition. See Pricing for the edition differences.

#Downloading the module files

The Module packages section of the Setup tab has a download button for WHMCS and one for Blesta. The package is built as a ZIP from the files on this server at download time, so after every panel update you get the module that matches that version. Paths inside the archive are relative to the billing system's root directory:

If a panel update brings new module files, download the package again and extract it to the same place.

#Billing system token

On the Tokens tab, click Create token and fill in:

The token starts with bpb_ and is shown only once, when it is created; the panel stores only its hash. Each person can have at most 20 tokens. Revoking a token also invalidates any sign-in links it created that have not been used yet. A token stops working if its owner loses the administrator or reseller role or is suspended. Temporary support administrators cannot create tokens.

#Certificate pinning

The modules never switch off certificate verification. If the panel's certificate is not verified by a public certificate authority (for example the self-signed certificate generated during installation), the page provides a hash of the certificate's public key as pin-sha256=…, and the module then accepts only a certificate with that key. In that case the token dialog shows a two-line Access Hash value for WHMCS: the first line is the token, the second the pin. Once the server has a valid certificate, no pin is needed; see SSL certificates.

#Reseller tokens

Resellers (a Pro edition feature) can open this page and create their own tokens. A reseller token only sees the reseller's own accounts and is bound by reseller privileges: creating, suspending and terminating accounts, changing packages and passwords, and logging in to the customer panel each require the matching privilege. Resellers cannot create reseller accounts. See Resellers, teams and branding.

#Setting up WHMCS

1. Extract the module package in the WHMCS root directory.
2. Create a token with system WHMCS and add the WHMCS server's address to its allowed IP list.
3. In WHMCS go to System Settings → Servers → Add New Server, choose the bipanel module, enter the hostname and tick SSL mode. The port is the Server Admin port: 2087 on a native server, usually 443 on a container installation; the Setup tab shows the exact value.
4. Paste the token into the Access Hash field (with the pin as a second line if one is needed). Username and password can stay empty. Check it with Test Connection.
5. Under Products/Services, open the product's Module Settings tab, select the bipanel module and the server group, then set the product options.

For usage sync, the disk and bandwidth update option must be enabled in the WHMCS Automation settings; during the daily cron run the module writes each account's disk and bandwidth usage and package limits to the service records. To bring accounts that already exist on the panel into WHMCS, use the Sync Accounts tool on the Servers page; accounts are matched by domain. The service screen in the admin area shows the account's status on the panel, its package, disk and bandwidth usage, domain / database / email counts and last login time. Module calls are written to the WHMCS module log with tokens and passwords masked.

#Setting up Blesta

1. Extract the module package in the Blesta root directory.
2. Create a token with system Blesta.
3. In Blesta go to Settings → Company → Modules → Available, install the bipanel module and add a server: server name, hostname, port (2087 on a native server, usually 443 on a container installation), Use SSL and API token. If the panel uses a self-signed certificate, enter the pin in the Certificate pin field. The token is tested against the panel when you save.
4. Under Packages → Create Package, select the bipanel module and the server, pick the bipanel package from the list and optionally turn on Reseller account and Permanent deletion.

The Blesta module keeps domain, username and password fields on the service; if the username is left empty, it is generated from the domain. Customers sign in with one click from the service's Control panel tab and use the quick link buttons; administrators see the account's status and usage on the service's bipanel tab. The Blesta module does not sync disk and bandwidth usage and has no account import tool.

#Service lifecycle

When an account is created and the username does not meet the panel rules (starts with a lowercase letter, 2–16 characters, only a-z and 0-9), the module generates a suitable one; if the name is taken, it tries up to three alternatives and saves the result to the service in the billing system. If the password does not meet the rules (8–128 characters; no spaces, quotes or backslashes), the WHMCS module generates a strong one and saves it to the service.

#Package mapping

The value in the product or package settings is matched against a panel package by name (case-insensitive). The list contains the packages the token owner can assign: the server administrator sees every package, a reseller sees their own packages and those shared with them. If the package cannot be found on the panel, the action fails; compare the name with Server Admin → Packages. For packages, see Accounts and packages.

#Deletion and archive

In the Pro edition, when Deleted Accounts is enabled and the product's Permanent deletion option is off, a terminated account is archived first and can be restored for the configured period. In the Community edition, or with Permanent deletion on, the account is deleted immediately and permanently.

#Single sign-on

When a customer clicks the login button in the billing system, the module asks the panel for a one-time, short-lived sign-in link and redirects the browser to it. Links live for 120 seconds by default, adjustable between 30 and 900 seconds on the Settings tab, where the Single sign-on from the billing system switch also turns the feature off server-wide. The WHMCS module adds quick links to the product details page in the client area, leading to files, email, databases, domains, DNS, SSL, backups, FTP, cron, PHP and more. For services marked as reseller, the login button opens Server Admin.

Some rules always apply:

• Suspended accounts and server administrator accounts cannot sign in with a link.
• Signing in to Server Admin as the token owner is only possible with a token that has Single sign-on to Server Admin enabled, and only from the billing system's admin area. With this option on, the token can open a Server Admin session without two-factor authentication, so fill in the allowed IP list.
• Sign-ins requested from the billing system's admin area count as "log in as" sessions and follow the server's support access consent rules.

#Troubleshooting

Start with the Log tab: every failed call appears with its error message and source IP. Common cases:

For the difference between the billing API and general API tokens, see API and CLI.