Skip to main content

​
Creating a token

  1. Log in to your reseller dashboard at /dashboard
  2. Go to Settings → API Tokens
  3. Click New token
  4. Give it a descriptive name (e.g. WHMCS provisioning)
  5. Select the required scopes
  6. Optionally add an IP allowlist (comma-separated CIDRs or IPs)
  7. Click Create and copy the token — it is shown only once

​
Token format

A Laravel Sanctum personal access token: a numeric token ID, |, then a random string prefixed with pdns_ (the prefix makes leaked tokens detectable by GitHub/TruffleHog-style secret scanners). Pass the whole string — including the id| part — as the Bearer token.

​
Security recommendations

  • Create one token per integration with minimum required scopes
  • Store tokens in a secrets manager (Doppler, AWS Secrets Manager, HashiCorp Vault) — never in source code
  • Enable an IP allowlist for production tokens to limit blast radius if a token is leaked
  • Rotate tokens after any security incident

​
Revoking a token

Go to Settings → API Tokens, find the token, and click Revoke. Revocation is instant.

​
Admin-managed tokens

Platform operators can create and revoke tokens for any org via Admin → Orgs → the org’s detail page → API Tokens.