Skip to main content

Authentication

The API requires two request headers. The public documentation includes a PHP token expression, but the production verifier's exact byte-level contract has not been independently validated.

Headers​

  • username: the email address of the reseller's client registered in WHMCS
  • token: a value generated from the API key, username, and current UTC hour

The published PHP expression is:

base64_encode(hash_hmac("sha256", "<api-key>", "<email>:".gmdate("y-m-d H")));

Validation notice

The expression above reproduces the currently documented PHP implementation. Exact HMAC key/data ordering, raw-versus-hex digest encoding, token lifetime, token reuse, UTC-hour rollover behavior, and clock-skew tolerance are still VALIDATION REQUIRED against the production verifier.

Until byte-level test vectors are published, avoid independently translating the token-generation algorithm to another programming language unless the resulting token is verified against the live API.

Under PHP's hash_hmac argument order and defaults, that expression uses:

  • HMAC data: the API key
  • HMAC key: <email>:<two-digit UTC year>-<month>-<day> <hour>
  • HMAC output: lowercase hexadecimal text because raw_output is omitted
  • Token output: Base64 of that hexadecimal text

This describes what the PHP expression evaluates. It does not prove that the server intentionally requires that ordering and encoding.

VALIDATION REQUIRED: Authentication failure HTTP status and response body.

Published PHP Example​

PHP token generation
$headers = [
    "username: [email protected]",
    "token: ". base64_encode(hash_hmac(
        "sha256",
        "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
        "[email protected]:".gmdate("y-m-d H")
    ))
];
Get version string
curl --request GET \
  --url "https://my.register.ly/modules/addons/DomainsReseller/api/index.php/version" \
  --header "username: [email protected]" \
  --header "token: <generated-token>"

Do not embed the API key in browser JavaScript or public documentation examples.

Node.js, Python, Go, Java, and C# token generators are intentionally not published until the byte-level authentication contract has verified test vectors.