Categories

Affiliates
1
Backups & Restore
55
cPanel & Hosting
71
cPanel AI & Site Creation
32
Domains & DNS
53
Email
32
SSL & Security
67
System Status
2
Troubleshooting
55
WordPress & WP Toolkit
31

  Categories

  Tag Cloud

2fa 301 302 403 404 500 502 503 504 a-record aaaa-record account Account Information account-backups account-data accounts actions addon-domain address-importer advanced Affiliate ai ai-assistant alias alias-record analytics apache api-token approval archive ask-ai assets authentication automatic-reply automatic-updates automation autoresponder autossl availability awstats backup backup-wizard bandwidth best-practices boxtrapper browser bulk ca-bundle caa cache calendar catch-all certificate certificate-chain certificates change-management checklist claude-code cleanup clone cloudlinux cname comparison compatibility compression configuration conflict connections contacts contents context copy copy-data cPanel cpbackup-exclude.conf credentials critical-error cron crt csr csv data-loss database date dcv ddns debug debugging default-account default-address delegation delete delete-record deliverability delivery deluxe deployment deprecated detach details development diagnostics directories directory directory-privacy disconnect disk-space disk-usage dkim dmarc DNS dnssec document-root domain domain-management Domains dotfiles download ds-record dv dynamic-dns ecdsa edit-record editor email email-account email-filters encryption environment error-pages errors ev exclude expiration expired export faq feature-manager file file-manager file-transfer files filters folders forwarder forwarders forwarding ftp full-backup getting-started git global-filters gnupg greylisting guided-setup handlers hardening home-directory Hosting hostname hotlink htaccess http http3 https https-record images imap import imports indexes indexing install integration-links integrity ip ip-blocker ipv4 ipv6 jupiter key-type keys leech-protection limitations limits litespeed local-backup login logs mail-client mailbox mailing-list mailman maintenance maintenance-mode manage-team management manual-backup manual-install mariadb mass-management mcp memory memory-limit meridian metrics Migration mime-types mixed-content modsecurity move multiphp multiple-sites mx My Account mysql Name Servers nameservers navigation network nodejs notifications nova nxdomain organization ov overwrite parked-domain partial-backup passive-mode password password-protection passwords paths performance permalinks permissions phishing php php-fpm php.ini phpmyadmin plugins plus-addressing pop3 powerdns preferences privacy private-key privileges propagation protocol proxy public_html quota raw-access rdap records recovery recovery-mode redirect redirects registered-domain registrar remote-access remove remove-domain rename rename-domain renewal repair repository reset reset-zone resource-usage resources restore restore-point restrictions retention revoke rollback router routing rsa rules scan scheduled-backup scheduled-tasks scope scp search security security-policy security-risk self-signed seo servfail sets settings sftp sharing shell Site Monitoring site-url sitejet smart-updates smtp spam spamassassin spf srv ssh SSL staging status storage subdomain suspend svcb system-user tar.gz tasks temporary-domain terminal themes time timeout timeouts tls track-delivery transfer trash troubleshooting ttl txt updates upload uploads users vacation verification verify version-control visitors vulnerabilities waf Web Design Web Hosting web-apps web-disk web-errors webdav webmail webpros website website-builder white-screen whois wildcard wizard WordPress wp-admin wp-cron wp-toolkit www zip zone-editor

  Support

My Support Tickets
Announcements
Knowledgebase
Downloads
Network Status
Open Ticket

Why API Tokens Are Better Than cPanel Passwords for Automation Print

  • api-token, automation, password, security
  • 0

For unattended API automation, use an API token instead of embedding the cPanel account password.

Tokens can be named, expired, and revoked without changing the primary account password. Current cPanel security guidance also treats API tokens as the supported method for unattended API authentication when stronger 2FA-related API policies are enabled.

Store tokens in a secrets mechanism or protected configuration, not in public source code or browser-delivered JavaScript.

Was this answer helpful?

Related Articles

What SSL/TLS and HTTPS Do for a Website SSL/TLS encrypts traffic between a client and a server. For websites, this is what allows a... How to Use the Current cPanel SSL/TLS Interfaces Current cPanel versions can present certificate tools in more than one layout. On cPanel 134 and... How to Check SSL Certificate Status for Your Domains Use cPanel → Security → SSL/TLS Status, or the equivalent Status tab in the unified SSL/TLS... What Is AutoSSL in cPanel? AutoSSL is cPanel & WHM functionality that can automatically provision and renew... How to Run AutoSSL Manually in cPanel If AutoSSL actions are enabled for the account, you can request an AutoSSL run from cPanel →...
« Back

  Tag Cloud

2fa 301 302 403 404 500 502 503 504 a-record aaaa-record account Account Information account-backups account-data accounts actions addon-domain address-importer advanced Affiliate ai ai-assistant alias alias-record analytics apache api-token approval archive ask-ai assets authentication automatic-reply automatic-updates automation autoresponder autossl availability awstats backup backup-wizard bandwidth best-practices boxtrapper browser bulk ca-bundle caa cache calendar catch-all certificate certificate-chain certificates change-management checklist claude-code cleanup clone cloudlinux cname comparison compatibility compression configuration conflict connections contacts contents context copy copy-data cPanel cpbackup-exclude.conf credentials critical-error cron crt csr csv data-loss database date dcv ddns debug debugging default-account default-address delegation delete delete-record deliverability delivery deluxe deployment deprecated detach details development diagnostics directories directory directory-privacy disconnect disk-space disk-usage dkim dmarc DNS dnssec document-root domain domain-management Domains dotfiles download ds-record dv dynamic-dns ecdsa edit-record editor email email-account email-filters encryption environment error-pages errors ev exclude expiration expired export faq feature-manager file file-manager file-transfer files filters folders forwarder forwarders forwarding ftp full-backup getting-started git global-filters gnupg greylisting guided-setup handlers hardening home-directory Hosting hostname hotlink htaccess http http3 https https-record images imap import imports indexes indexing install integration-links integrity ip ip-blocker ipv4 ipv6 jupiter key-type keys leech-protection limitations limits litespeed local-backup login logs mail-client mailbox mailing-list mailman maintenance maintenance-mode manage-team management manual-backup manual-install mariadb mass-management mcp memory memory-limit meridian metrics Migration mime-types mixed-content modsecurity move multiphp multiple-sites mx My Account mysql Name Servers nameservers navigation network nodejs notifications nova nxdomain organization ov overwrite parked-domain partial-backup passive-mode password password-protection passwords paths performance permalinks permissions phishing php php-fpm php.ini phpmyadmin plugins plus-addressing pop3 powerdns preferences privacy private-key privileges propagation protocol proxy public_html quota raw-access rdap records recovery recovery-mode redirect redirects registered-domain registrar remote-access remove remove-domain rename rename-domain renewal repair repository reset reset-zone resource-usage resources restore restore-point restrictions retention revoke rollback router routing rsa rules scan scheduled-backup scheduled-tasks scope scp search security security-policy security-risk self-signed seo servfail sets settings sftp sharing shell Site Monitoring site-url sitejet smart-updates smtp spam spamassassin spf srv ssh SSL staging status storage subdomain suspend svcb system-user tar.gz tasks temporary-domain terminal themes time timeout timeouts tls track-delivery transfer trash troubleshooting ttl txt updates upload uploads users vacation verification verify version-control visitors vulnerabilities waf Web Design Web Hosting web-apps web-disk web-errors webdav webmail webpros website website-builder white-screen whois wildcard wizard WordPress wp-admin wp-cron wp-toolkit www zip zone-editor

  Support

My Support Tickets
Announcements
Knowledgebase
Downloads
Network Status
Open Ticket

Get on Track With the Right Domain

Every great website starts with the right domain. Search for yours today and get rolling today!

Get Started

Web Hosting at Full Throttle. Built for Every Level. Right Here in the Carolinas.

Get Started

Useful Links

Contact us