Provider accounts & regions

ImpulseVPS creates servers in cloud accounts you own. Add an API token for each account in ImpulseCore, test it, and map the locations you sell to each provider’s own datacenters.

1. Create an API token

ImpulseVPS supports four providers. Create a token in each account you want to sell from, with the access listed here:

Provider	Where to create it	Access it needs
Vultr	Customer Portal → Account → API → Personal Access Token	This Personal Access Token belongs to the account and has full access. A sub-user’s API key only carries that user’s permissions, so the user must be able to deploy and manage servers, including their firewalls, snapshots, and backups. Also allow your WHMCS server’s IP under Account → API → Access Control, or Vultr rejects the calls.
Hetzner Cloud	Cloud Console → your project → Security → API Tokens → Generate	Read & Write. Use the Cloud token, not the separate DNS token. Tokens are project-scoped, so connect one account per Hetzner project.
DigitalOcean	Control Panel → API → Tokens → Generate New Token	Read + Write (full access).
Linode (Akamai)	Cloud Manager → Profile → API Tokens → Create Personal Access Token	Least privilege: Linodes, Volumes, StackScripts, IPs, and Firewalls read/write (IPs covers reverse DNS; Firewalls covers the customer firewall); Domains read/write only if you use Linode DNS; Account read-only is optional (it lets SSH key labels resolve). Linode can’t add a scope to an existing token, so create a new token if one is missing. Turn off Backup Auto Enrollment (Account → Settings): with it on, Linode enrolls every new server in its paid Backups whatever the order bought. ImpulseVPS switches Backups off when a server that didn’t buy them is activated, and raises an alert when it can’t.

2. Add and test the account

Provider credentials live in ImpulseCore, not in the module’s own tables, so every Impulse module can share them:

1. Open ImpulseCore → Operations → VPS Providers.
2. Expand the provider, paste the token, and save. Credentials are encrypted at rest and never shown again.
3. Click Test connection. It makes a read-only call to the provider and reports exactly what to fix if the token is wrong.

To run more than one account of the same provider — for example a US and an EU Vultr account — use Add profile on that provider to add a named second account, and test it the same way. ImpulseVPS calls each of these a provider account.

Back in the module, ImpulseVPS → Settings → Providers & Regions lists every account with its credential and location status, a Test connection button, and a link to manage accounts in Core.

Test before you build on it

A saved token isn’t assumed to work. Test each account before you create a server plan for it.

Each server stays with its account

The account a server was created in is recorded with it for life. Power actions, rebuilds, and deletion keep using that account even if you later connect its WHMCS product to a different server plan.

3. Map selling locations

Customers pick a location by your name for it; ImpulseVPS turns that into the provider’s own datacenter code. Locations come from ImpulseCore’s shared region list:

1. Open ImpulseCore → Projects → Regions.
2. Add a region with your customer-facing name, then add the matching region code for each provider you sell there. Load from providers can import candidates from a connected account.
3. Enable the region. Only enabled regions are offered to customers.

A server plan only offers a location that has a code for its provider. A location never switches providers: it picks a datacenter inside the server plan’s own provider account.

Locations are a hard constraint

ImpulseVPS never places a server somewhere other than where it was ordered. Publishing offers only locations with a code for the server plan’s provider; an order naming one without a code is refused when WHMCS runs the module’s Create, after checkout. A size the provider doesn’t sell in the chosen location is found only when the server is created, after the order is accepted and usually paid: nothing is created, and you get a critical alert. Allow only locations that sell every size on the server plan.

4. What each provider supports

ImpulseVPS checks what a provider supports, not which provider it is. A client tab or option appears when the provider supports it and is hidden — not broken — when it doesn’t.

Capability	Vultr	Hetzner	DigitalOcean	Linode
Power, rebuild, and resize	✓	✓	✓	✓
Firewall with lockout check	✓	✓	✓	✓
Snapshots	✓	✓	✓	With Backups
Automatic backups (paid option)	✓	✓	✓	✓
IPv6 (sellable option)	✓	✓	✓	Always on
Reverse DNS	✓	✓	✓	✓
Browser console	✓	✓	—	—
Additional block storage	✓	—	—	—
One-click applications	✓	—	—	—

Backups are a billable provider service, so ImpulseVPS switches them on only for a server whose service includes the paid Backups option. On a provider without a browser console, the Console tab is simply not shown.

On Linode, snapshots use the paid Backups service: a customer needs the Backups option before they can take one, and each server keeps a single manual snapshot, which the next snapshot replaces. Linode also gives every server an IPv6 address, so IPv6 is never a paid choice there: ImpulseVPS leaves the IPv6 option off Linode order forms.

Vultr’s console names the provider

It opens on Vultr’s own domain, which hidden provider visibility can’t change. If you hide the provider on Vultr server plans, ask Vultr support to set up a white-label console domain for your account, and keep Console off on those server plans until it is in place.

5. How ImpulseVPS reaches your servers

Your customers hold root on the servers you sell, so the provider’s API is the entire management plane:

• Nothing runs inside the guest. There is no agent and no proxy, and WHMCS never connects to a customer server over SSH — not even for break-glass access.
• Cloud-init stays secret-free. It carries only the hostname, the customer’s SSH keys, password-login hardening, and the customer’s own optional startup script.
• Every action is typed and audited. Each change is a typed request with a request ID, checked against the customer’s own service, and written to the audit log. A missing credential refuses the action; the module never falls back to another account.

Prove an account before you sell

ImpulseVPS → Diagnostics → Health Checks confirms each account’s credentials and catalog reads without creating anything. The synthetic test goes further: it creates a throwaway server on the account you pick, waits for it to come up, and always deletes it — even after a timeout or an error. If that delete itself fails, you get a critical alert instead of a silent leak.

The synthetic test costs money

It creates a real, billable server for a few minutes, so it only runs when you start it and confirm. Run it once per account after you connect it and after any change on the provider’s side.