Generate a new API key for a reseller (secret returned ONCE)

POST 
/admin/keys

When a customer clicks "Become a Reseller", the Rabisu WHMCS master module calls this endpoint to generate an API key + secret for that customer (reseller). NOT HTTP Basic Auth — protected by the X-Admin-Token header (server-to-server).

SECURITY:

• admin CANNOT be granted in permissions (422 forbidden) — this channel only issues reseller-scoped keys; it cannot issue an admin key that bypasses ownership checks.
• api_secret (plaintext) is returned only once, in this response; only a bcrypt hash is stored in the DB. If lost, a new key must be generated.
• webhook_secret (HMAC) is also returned only once, in this response. It is pasted into the Webhook Secret field of the reseller module. POST /webhooks does not regenerate this secret.

Request

Responses

201

Key generated (secret ONCE)

401

X-Admin-Token missing or wrong (unauthorized)

403

Admin API not configured (ADMIN_API_TOKEN empty → admin_disabled)

422

Invalid input — reseller_id missing/invalid (invalid_input) or admin in permissions (forbidden).

500

Key could not be generated (internal_error)