Admin

Server-to-server admin channel (X-Admin-Token, NOT BasicAuth). When a customer clicks "Become a reseller", the Rabisu WHMCS master module uses these endpoints to generate/list API keys for that customer. Cannot be accessed with reseller API keys.

📄️Generate a new API key for a reseller (secret returned ONCE)

When a customer clicks 'Become a reseller', the Rabisu WHMCS master module calls this endpoint to generate an API key + secret for that customer (reseller). NOT HTTP Basic Auth — protected by the `X-Admin-Token` header (server-to-server).

📄️List a reseller's active API keys (NO secret)

Returns the active (is_active=1) API keys for the specified `reseller_id`. The secret hash or plaintext is NEVER returned — only metadata.

📄️Rotate the reseller API key secret (secret returned ONCE)

The public part of `api_key` DOES NOT CHANGE; only the secret is rotated. The old secret becomes invalid IMMEDIATELY (immediate rotate — 24h grace / dual-secret v2 backlog). The APCu auth cache is invalidated. The `reseller_id` in the body is an ownership guard — another reseller's key returns 404 `key_not_found` (isolation, no leak).

📄️Revoke the reseller API key (soft delete)

Immediately deactivates the key (`revoked_at` set) + invalidates the APCu auth cache. The record is preserved for audit. The `reseller_id` in the body is an ownership guard — another reseller's key returns 404 `key_not_found`.