Registering a cPanel/WHM server

This is the step that replaces VPS provisioning: create a WHM API token, point the module at a cPanel & WHM server you already run, and choose how it checks the server’s certificate.

1. How the module talks to cPanel

Everything runs over cPanel’s own APIs on the server’s WHM port, authenticated with one WHM API token per server (the one exception is the client area’s list of installed applications, which uses a one-time session as the customer’s account on the cPanel port — see step 4):

• WHM API 1 (https://<host>:2087/json-api/…) for the server and account level — creating, suspending, unsuspending and removing accounts, changing an account’s package or password, listing packages, reading the server’s version, usage and backup settings, and minting one-time sign-ins.
• cPanel UAPI, run as the account through WHM, with the same token, for most things inside an account — domains, email, databases, SSL, FTP, files, PHP versions, backups. The older cPanel API 2, also run as the account, handles the DNS zone editor, scheduled tasks and the remote-MySQL host list.

There are no per-account tokens. The token is stored encrypted, belongs to that one server (never a global key), and is sent over TLS as an Authorization: whm <user>:<token> header — root, unless you set another WHM API user. Because every per-account call runs as the account itself, a customer’s lists come from their own account only — on a shared server they never see another customer’s domains, mailboxes, databases or files.

No SSH

ImpulseCpanel never connects to your servers over SSH — it has no SSH code path and no break-glass toggle, and there is no free-form shell over the API; every change is a typed API call. The only Impulse code that can run on a cPanel server is the optional Imunify status reporter, which you install yourself.

2. Create a WHM API token

On the cPanel & WHM server:

1. Sign in to WHM as root and open Development → Manage API Tokens.
2. Click Generate Token and give it a name, such as ImpulseCpanel.
3. Grant it full access (All Features). A token with fewer privileges fails part of the work: the module creates, suspends and removes accounts, changes their passwords, signs customers in to their control panel, reads disk and bandwidth use and the backup settings, and runs each account’s own operations (mail, databases, DNS, files and more) through WHM.
4. Copy the token — WHM shows it once.

To list or revoke tokens later, return to Manage API Tokens in WHM. Keep the token secret: it grants full API access to the server.

3. Add the server in WHMCS

Open ImpulseCpanel → Infrastructure → + Add Existing Server. The page lists what the server needs first, then the form:

1. Enter a Name (a label for you), the WHM hostname (FQDN or IP) and the WHM API port (2087 unless you changed it).
2. Optionally enter the server’s IP address. When you do, the module connects to that IP while still checking the certificate against the hostname — useful before the hostname resolves to the server.
3. Enter a Region slug — an ImpulseCore region. Orders that name a region are placed only on that region’s servers.
4. Keep the WHM API user as root (or the root-equivalent user that owns the token) and paste the token into WHM API token. It is stored encrypted. A user name with a space or a colon is refused.
5. Optionally set a Capacity — the number of accounts the server takes before it stops receiving new ones (0 = unlimited).
6. Choose a TLS mode (see the next step), leave Active ticked, and click Add server.

There are no shared-IP or nameserver settings for new accounts (the IP address field above is only the address the module connects to): the module passes neither to WHM, so a new account gets WHM’s defaults — normally the server’s main shared IP and the nameservers set in WHM.

To change a server later, open it from Infrastructure → Manage Servers (its name, or Edit / details in its ⋮ menu). Leave WHM API token blank to keep the stored token. The edit form shows the stored WHM API user; change only the user and the stored token is kept, now sent as that user.

4. Choose a TLS mode

Pick how the module checks the server’s certificate:

• Verify certificate (CA) — use this when the server has a real, publicly trusted certificate for its hostname. That certificate must be valid on the cPanel port (2083) as well as on WHM (2087): the client area’s list of installed applications connects there too.
• Skip verification (self-signed) — use this for a self-signed certificate. The connection is still encrypted; it just isn’t chain-validated.

The mode is per server and applies to every connection the module makes to it.

5. Test the connection

Open the server’s ⋮ menu and choose Test connection. It calls WHM’s version function with the token, records the cPanel & WHM version on the server, and marks the server Online and Healthy; a failure marks it Offline and Down, with WHM’s reason in the result. The module repeats the same check every 15 minutes (the health_version_poll task), so a server’s status stays current.

A server takes new accounts only while its last check passed. A new server takes none until Test connection or the 15-minute check passes (its page says Bring … online until then), and a server whose last check failed takes none until a check passes again (its page says it is not taking new accounts).

Where new accounts go

A new order goes to the least-full active server whose last check passed and that still has room — among the servers the plan may use (see Plans & WHMCS products), and in the order’s region when it names one. An order for a region with no room fails (no capacity in region …) rather than landing elsewhere. “Least-full” is the server’s account count divided by its Capacity; for an unlimited server (capacity 0) the count is divided by 1,000,000 instead, so it looks almost empty and is picked ahead of nearly any capped server that already holds accounts. The count is the accounts ImpulseCpanel created or linked on the server, until they’re removed — not every account on it.

If the test fails, the usual causes are a wrong or revoked token, the WHM port not reachable from WHMCS, or a TLS-mode mismatch (try Skip verification for a self-signed certificate). See Troubleshooting for more.

6. Sign in to WHM, or forget a server

Each server’s ⋮ menu (and its detail page) also has:

• Log in to WHM — creates a one-time WHM sign-in as root and shows the link once, on the page that follows. It expires in about a minute, and whoever opens it is root on the server, so don’t share it. Use it for what the module leaves to WHM: backups, packages, AutoSSL and plugins such as Imunify360.
• Forget server — removes the server from ImpulseCpanel; the server and its accounts are not touched, and ImpulseCore retires its security records. It’s available only when no account is on the server in any state, including accounts still in their termination grace, and you confirm by typing the server’s hostname.

Region names: Settings → General & Access → Region labels sets the name customers and the admin see for each region slug your servers carry.