Generate a new API key for a reseller (secret returned ONCE)

POST 
/admin/keys

When a customer clicks "Become a reseller", the Rabisu WHMCS master module calls this endpoint to generate an API key + secret for that customer (reseller). NOT HTTP Basic Auth — protected by the X-Admin-Token header (server-to-server).

SECURITY:

• admin CANNOT be granted in permissions (422 forbidden) — this channel only generates reseller-permitted keys, it cannot generate an admin key that bypasses ownership checks.
• api_secret (plaintext) is returned only once in this response; only a bcrypt hash is kept in the DB. If lost, a new key must be generated.

Request

Responses

201

Key generated (secret ONCE)

401

X-Admin-Token missing or wrong (unauthorized)

403

Admin API not configured (ADMIN_API_TOKEN empty → admin_disabled)

422

Invalid input — reseller_id missing/invalid (invalid_input) or admin in permissions (forbidden).

500

Key could not be generated (internal_error)