How to Create an API Token for Third-Party Apps in cPanel or DirectAdmin

If you want a backup service, a monitoring tool, or a script you wrote to connect to your hosting account, you don't have to hand over your main password. Both cPanel and DirectAdmin let you create a separate API token (sometimes called a login key) that gives an application access to specific functions on your account. If the tool is ever compromised or you stop using it, you simply revoke the token instead of changing your main password everywhere.

Why use a token instead of your password

Your main password controls your entire account, including billing-sensitive areas and the ability to change your own password. A token can be limited to what a specific tool actually needs, it can be set to expire automatically, and it can be revoked on its own without locking you out of your own account.

Treat an API token exactly like a password. Anyone who has it can act on your account through the API, so never paste it into a public script, a shared document, or a support ticket.

Creating the token

In cPanel

1. Log in to cPanel.
2. In the Security section, click Manage API Tokens.
3. Click Create.
4. Give the token a name you'll recognize later, such as the name of the tool that will use it.
5. If you want the token to stop working automatically after a set period, choose an expiration date. Otherwise leave it set to never expire.
6. Click Create to generate the token.
7. Copy the token value immediately. cPanel shows it only once, and you won't be able to view it again after you click Done.

In DirectAdmin

1. Log in to DirectAdmin.
2. Open Advanced Features and look for Login Keys (some DirectAdmin themes label this API Keys instead).
3. Click Create New Key.
4. Enter a name for the key so you remember which tool it belongs to.
5. Choose which parts of your account the key is allowed to access. Only grant the specific permissions the tool actually needs rather than full access, unless the tool genuinely requires it.
6. If the tool always connects from the same IP address, enter that address to restrict the key to it. This stops the key from working if it's ever used from anywhere else.
7. Click Create and copy the key value shown. Like cPanel, DirectAdmin typically displays it only once.

Using and managing your tokens

• Paste the token into the third-party tool's own settings, usually in a field labeled "API Token," "API Key," or "Login Key."
• Give each tool its own token rather than reusing one token everywhere. That way, revoking access for one tool doesn't affect the others.
• Check your token list every so often and revoke any you no longer recognize or no longer use.
• If you ever suspect a token has leaked, revoke it immediately from the same Manage API Tokens or Login Keys page and create a new one.

If you'd rather give a developer full access to make changes on your behalf without sharing your password at all, you can also set up SSH key authentication for that kind of access instead.