Authentication

Authentication is handled with two headers: username and token.

The username value is the reseller client's WHMCS email address. The public PHP expression combines the API key, email address, and current UTC hour with HMAC-SHA256, but its intended key/data ordering and digest encoding still require backend validation.

See Getting Started: Authentication for the exact published expression, its PHP evaluation, and the remaining validation requirements.