WHMCS Apps help

API 1

• Using the API directly Every endpoint lives under /modules/addons/whmcspwa/api/index.php. Send an Authorization: Bearer header with the access token. The reference screen lists the live route table, generated from the router itself.

Branding 4

• App icons Supply a 192px and a 512px PNG. Square, no rounded corners and no transparency: each platform applies its own mask, and a transparent icon comes out with a black backing on iOS.
• Brand colour and accent The brand colour paints the app's primary buttons, links and the phone status bar. The accent is reserved for things that need attention, like an overdue invoice. Keeping them distinct is what makes an unpaid balance readable at a glance.
• Pastel, light, dark and automatic Automatic is the default and follows whatever the phone is set to: your light palette during the day, the dark theme at night. Pastel is an off-white background with soft lines, light is the same layout in cooler greys, and…
• The icon that ships with the module Until you upload your own, the app uses a stack of rack units with one lit status light. It is deliberately generic, and it is a real icon rather than a coloured square, so an install with nothing configured still…

Features 8

• Attaching a photo or file, and who sees it Staff can attach files to a ticket from a phone, including straight from the camera, and choose whether the client sees them. It defaults to staff only, and that default is the point: the mistake worth designing against is a…
• Attaching a screenshot to a new ticket When opening a ticket in the customer app there is an optional attachment area under the message: Choose a file picks anything from the device, and Take a photo opens the camera, which is the quick way to attach a…
• Closing your own ticket A service on a cPanel server shows a cPanel section under Usage once the account is active, with the everyday tools. Choosing one opens cPanel in a new tab, signed in and landed on that tool, with no password to…
• Files on a ticket Attachments appear under the message they came with and download on a tap. Serving files from disk is the most dangerous thing this module does, so the rules are strict: the link names the file rather than the caller doing…
• Opening cPanel A service on a cPanel server shows a cPanel section under Usage once the account is active, with the everyday tools: File Manager, Email Accounts, Databases, phpMyAdmin, Backups and more. Choosing one opens cPanel in a new tab, signed in…
• Printing an invoice The app renders its own printable copy rather than fetching the WHMCS PDF, because that PDF is served behind a client area session the app does not hold, and asking someone to sign in twice to see their own invoice…
• Turning sections on and off A section that is switched off disappears from the app's navigation and its API endpoints start refusing requests. Both happen together, so hiding a screen genuinely withholds the data rather than only hiding the button.
• What clients see first A service on a cPanel server shows an Open cPanel button under Usage once the account is active. It signs you straight into cPanel in a new tab with no password to type, landing on the cPanel home where File…

Guides 7

• Guide: Get clients onto the app The announcement, the install, and what to do about iPhones.About 30 minutes.Set the app address Point a subdomain such as app.yourhosting.com at the app and use it everywhere. A short address is the difference between people typing it and people…
• Guide: Handle a ticket from phone to resolution What a client sends, what staff see, and how offline replies behave.About 10 minutes.Turn on tickets Clients get a list of their tickets and can open new ones against any department you have configured in WHMCS.A client opens a ticket…
• Guide: Invoice to payment on a phone How a notification becomes a settled invoice.About 10 minutes.The invoice is raised WHMCS creates the invoice as usual. The app hooks that event and notifies the client, with the amount and due date in the notification body.They tap the notification…
• Guide: Launch the app for the first time From a fresh install to a client tapping your app on their home screen.About 15 minutes.Run setup The wizard checks HTTPS, PHP extensions and your WHMCS version before anything else, so you find out about a blocker now rather than…
• Guide: Put the install code where it gets scanned From the generated code to clients with the app on their home screen.About 30 minutes.Fix the app address before printing anything The code encodes whatever address is set here. Print it, then change the address, and every printed code points…
• Guide: Turn on passkeys without a support wave Enable them, prove they work on your own device, then let people find them.About 20 minutes, then a week of watching.Decide the domain first Before anyone enrols, settle the domain passkeys bind to. If the app might move to app.yourhosting.com…
• Guide: When something is not working The checks that resolve most reports, in the order worth trying.About 5 minutes.Check the health panel first It reports HTTPS, PHP extensions, the API admin account and the notification keys. Most problems are one of those four being unset.Nobody can…

Install 2

• Getting the code in front of people The client area panel does the work automatically: someone signed in at a desktop sees the code, someone on a phone sees an install button instead, because a phone cannot scan itself. Beyond that, the two placements that actually convert…
• The install code A QR code holding your app address, generated by the module rather than a third-party service, so no outside company learns your client traffic. It always reflects the app address on the Branding screen. Print it on invoices, show it…

Notifications 4

• Notification keys VAPID keys identify your server to Apple, Google and Mozilla's push services. Generate them once. Regenerating invalidates every existing subscription, so everyone has to turn notifications on again.
• Notifications on iPhone iOS only delivers web notifications after the app has been added to the home screen, and the permission prompt has to come from a tap. The app asks on the Notifications screen rather than on first load for exactly this…
• Notifying staff about tickets With notifications on, staff can also be told about tickets: when a new one is opened, and when a customer replies to an existing one. A reply on a ticket that is assigned to a particular staff member goes to…
• What triggers a notification Invoice created, payment received, payment failed, and a staff reply on a ticket. Each is a separate WHMCS hook, so you can turn one off without touching the others.

Offline 1

• What works without a signal The last screens someone loaded stay readable, and a ticket reply written offline is queued and sent the moment the connection returns. Payments always need a live connection.

Passkeys 6

• Locking the app A device can be set to lock the app when it goes into the background, so reopening needs a fingerprint. The obvious way to build that is a prompt in front of the existing session, but it would be theatre:…
• Requiring a fingerprint, face or PIN With this on, the device must confirm who is holding it before it will sign, so a phone someone picked up unlocked is not enough on its own. With it off, presence alone is accepted: a tap on the security…
• Staff accounts with two-factor authentication WHMCS publishes no supported way to verify a staff second factor from outside its own login form. Checking only the password would make this app the easy way past a control you deliberately switched on, so accounts with two-factor cannot…
• The domain passkeys are bound to A passkey is tied to one domain and its subdomains, and that binding is what makes it impossible to phish. Blank means the module derives it from your app address. Set it deliberately if you might move the app later:…
• What a passkey is A key pair the phone or laptop creates and keeps behind its own lock screen. Signing in means the device signs a one-time challenge with the private half, which never leaves it and never crosses the network. There is no…
• When someone loses the device Their password still works, so nobody is locked out. Passkeys stored in iCloud Keychain or Google Password Manager also follow the person to a replacement device on their own. If a device is genuinely lost, sign in with the password,…

Security 4

• Rate limit Requests per minute from one IP address. Sign-in attempts are capped separately and more tightly. Raise this if a large office behind one address gets blocked.
• Rotating the signing key Rotating signs everyone out of the app everywhere, immediately. Use it if you suspect a token has leaked. Nobody loses data; they just sign in again.
• Sessions and tokens Signing in returns a short-lived access token and a long-lived refresh token. Refresh tokens rotate on every use; if an old one is presented again the whole session is revoked, which is how a stolen token gets caught.
• Why staff sign-in needs a check at all WHMCS publishes a supported call for validating a client password, and none for validating a staff one, so the app has to read the stored hash itself. Where that hash lives changed between WHMCS versions: older installs keep it on…

Setup 5

• API admin account The app checks passwords and opens tickets by calling WHMCS as this administrator. Pick a dedicated account with only the permissions the app needs rather than a person's day-to-day login, so you can revoke it without locking anyone out.
• Getting the app onto a home screen Android and desktop Chrome show an install prompt automatically once the app has a manifest, an icon of at least 192px, and a service worker. iOS has no prompt: people use Share, then Add to Home Screen. The app detects…
• Showing error detail Normally when a request fails the app shows a short, generic message and the real detail goes to the activity log. With this on, that real message and where it happened come back in the app too. It is meant…
• Verifying the cPanel certificate To open cPanel, the app signs the customer in through the cPanel server's own API over a secure connection. That connection's certificate is checked by default. Some servers present a self-signed or hostname-mismatched certificate on their API port, which makes…
• Why HTTPS is required Browsers refuse to install a home screen app, register a service worker, or deliver notifications over plain HTTP. Localhost is the one exception, which is why testing works before your certificate does.

Staff 19

• Acting on a service or a domain From a client screen, each service carries the actions that suit its state: suspend an active one, unsuspend a suspended one, run the create/setup for one still pending. A suspension asks for a reason, because that reason is the only…
• Adding an internal note A ticket screen has an Internal note box for staff, below the reply box. What you write there is saved as a WHMCS ticket note — staff only, and the customer is never notified. It is for the running commentary…
• Cancelling an invoice An unpaid, draft or overdue invoice can be cancelled from its own screen, which stops WHMCS chasing it for payment. It is offered on the phone because it is reversible: a cancelled invoice can be reinstated as unpaid from the…
• Client quick actions A client screen carries a set of actions for the things staff do without opening a computer. Add credit puts a balance on the account. Send password reset triggers the WHMCS reset email, so the customer gets the usual link…
• Contacting and acting on a client A client screen has call, text and email buttons at the top and a WHMCS button that opens their full record in the admin area. The first three are device links: they hand off to the phone's dialer, messages app…
• Controlling what customers can do You control what customers can see and do in the app at two levels. Account, Customer app permissions sets the defaults every customer inherits: for each thing, such as paying invoices, opening tickets or opening cPanel, a switch decides whether…
• Inviting customers to the app You can email customers a link to the app with instructions to add it to their home screen; they sign in with the account they already have. Send to one from their client screen with the Invite button, or to…
• Opening a client Tapping a client anywhere in the app opens one screen holding what they have, what they owe and what they are waiting on: services with their status, domains with days to expiry, invoices with unpaid first, and any open tickets.…
• Overriding one customer A customer screen has App permissions, where the defaults can be overridden just for that customer. Every permission shows three choices: Default follows the global setting, On forces it available for this customer whatever the default, and Off takes it…
• Posting a network issue A service on a cPanel server shows the cPanel tools under Usage once the account is active, plus an Open cPanel button. Choosing a tool signs the customer in and, where the server allows it, lands straight on that tool's…
• Reading the dashboard The dashboard has three pages: income, orders and support. Swipe between them, or tap the names above them, which is the quicker route to the third one. Income counts money actually received, which is not the same as money invoiced:…
• Recent activity Recent activity, linked from the dashboard, is a single stream of what has just happened across the business: new orders, payments received, tickets opened and cancellations requested, most recent first, over the last month. The dashboard counters tell you how…
• Recording a payment received For money that arrived outside the app: a bank transfer, cash, a cheque. The app hands the payment to WHMCS through its own AddInvoicePayment call rather than writing to the ledger itself, so WHMCS decides whether the invoice is now…
• Saved replies on a phone The predefined replies already set up in WHMCS under Support appear in the app, grouped by category, and tapping one adds it to whatever is already in the reply box rather than replacing it. This is the feature that decides…
• Staying signed in Staff sign-in has a Keep me signed in on this device box. Leave it ticked and the session persists between visits as normal. Untick it and the session is held only until the app is fully closed, which suits a…
• Stopping a payment being entered twice Put the bank reference or receipt number in the Reference field. The app refuses a second payment carrying a reference already recorded against that invoice, which is what saves you when a phone loses signal mid-submit and you tap again.…
• The search box The dashboard has a search box that looks across clients, invoices, tickets and domains at once, so a customer on the phone can be found without knowing which list they are in. Type a name, company, email or phone number…
• Triaging a ticket A ticket opened in the queue shows a Triage panel for staff, under its status. From there its status, priority, department and the staff member it is assigned to can each be changed, and each takes effect the moment it…
• Working an order Tapping a pending order opens it with the same actions the official app offers, bar one: accept, cancel, cancel and refund, set as fraud, and back to pending. Each runs through the documented WHMCS order API, so it does exactly…

Support hub 4

• Opening the hub from Settings The hub is reached by staff from Settings on the You screen, where Open Keen2Support signs you into your own support desk with your name and email carried across so you are not asked again. It is a link rather…
• The help feed the hub reads The hub does not receive help from this module; it fetches it. Once an hour it reads a feed this module serves and caches the articles, so a support agent handling a ticket can search them and paste an answer…
• What connecting to Keen2Support does Keen2Support is your own separate support desk with the makers of this app. Connecting registers this app with the hub using a product key taken from there, and the app is handed a site token it uses on every later…
• What telemetry is sent, and what is not Telemetry is off until you switch it on. When on, the events this app already records in its own activity log are mirrored to the hub: things like a sign-in, a payment recorded, a push sent. Before anything leaves the…

Tools 2

• Checking the server can send notifications Run "php modules/addons/whmcspwa/tools/selftest.php" on the server. It signs a token, signs a VAPID request and encrypts then decrypts a real push payload, without touching your database. Eighteen checks should pass. If the push ones fail, the server is missing the…
• Version numbers and upgrades The version in version.php is the one true answer; the Overview screen, the API and the app all read it from there. Three files the browser loads directly carry a copy so their cache clears on upgrade. "php tools/version.php –check"…

Your account 8

• Changing a domain setting A domain screen has a Settings section with three switches you can change yourself: auto-renew, WHOIS privacy and the transfer lock. Each shows its current state and flips when tapped, going straight to your account with the host. Auto-renew on…
• Changing your password Account, Change password asks for your current password and then a new one. The current password is checked first, so someone who picked up an unlocked phone cannot quietly change it. The new password needs to be at least eight…
• Editing your details Account, Your details, Edit your details lets you change your own contact information: name, company, email, phone and address. Saving writes straight to your account with the host, the same as editing it on their website would, so invoices and…
• Forgotten password On the sign-in screen, Forgot password takes an email address and asks the host to send a reset link to it. The link and the reset page are the host system own, exactly as on the website, so the app…
• Forgotten username Customers sign in with their email address, so there is no separate username to forget. Forgot username on the sign-in screen explains this and, if the email entered is on an account, sends a short reminder to it. As with…
• Paying everything at once When more than one invoice is outstanding, the home screen offers a single Pay all button showing the combined total, alongside a link to see the individual invoices. Paying all opens the host mass-payment page, which settles every unpaid invoice…
• Signed-in devices Account, Signed-in devices lists everywhere your account is currently signed in, with the device, its address and when it was last used, and marks the one you are on. Signing out a device you do not recognise ends its session…
• Your notifications When notifications are switched on and you have allowed them on a device, the things you are told about — a new invoice, a payment going through, a reply to a ticket — are also kept in the app under…