MaxPanel WHMCS Provisioning Module

Official WHMCS server/provisioning module for MaxPanel — automatically create, suspend, unsuspend, repackage, and terminate hosting accounts straight from your WHMCS order pipeline.

Learn more about MaxPanel at https://maxpanel.net.

Features

• Full account lifecycle: create, suspend, unsuspend, terminate
• Package upgrades / downgrades
• Client password changes
• Daily disk-usage import into WHMCS
• One-click Single Sign-On from the client area and admin area
• Automatic primary-domain creation on new orders
• Module call logging with secret redaction

Compatibility

WHMCS	PHP	Status
8.1 – 8.13	8.1+	Supported
9.0+	8.2+	Supported

Smarty 4 is required (shipped with WHMCS 8.13 and 9.0). The bundled client-area template avoids every Smarty tag removed in 9.0.

Install

1. Copy the modules/servers/maxpanel/ directory into your WHMCS install:

   cp -R modules/servers/maxpanel /path/to/whmcs/modules/servers/
   

2. In WHMCS go to System Settings → Servers → Add New Server.

3. Select Maxpanel as the server type.

4. Fill in:

   • Hostname: your panel hostname, e.g. panel.example.com
   • Username: any value (unused — WHMCS just requires one)
   • Access Hash: your MaxPanel API key (mxp_…). Create one in the panel under Settings → API Keys as the reseller or admin that will own the WHMCS-created accounts.
   • Secure: enabled

5. Click Test Connection — green means ready.

6. Create a WHMCS Product, set its Module to Maxpanel, and set the Package ID config option to the numeric id of a MaxPanel package the API key's owner has access to.

Development / self-signed TLS

For staging only, append ::noverify to the Access Hash to skip TLS verification. The bypass is honored only when the MAXPANEL_ALLOW_INSECURE_TLS environment variable is set on the WHMCS host; otherwise verification stays on and Test Connection warns you. Never use this on production servers.

Troubleshooting

• Every API call is logged via WHMCS's standard logModuleCall. View it under Utilities → Logs → Module Log.
• "API key rejected" → the key was revoked, the owning account was suspended, or the key lacks the required role.
• "Account already exists" → safe to ignore on retries; the account is already provisioned.

License

Released under the MIT License.