Authentication

The OpenHost API uses Bearer token authentication. Every request must include a valid token in the Authorization header.

Obtaining a token

1. Generate in client area

   Client area → Profile → API Credentials → Generate new token.

2. Set scopes

   Choose which resources the token can access:

   Scope	Allows
   client:read	List and view client accounts
   client:write	Create, update, suspend clients
   service:read	View hosting services and plans
   service:write	Create, upgrade, cancel services
   support:read	View tickets
   support:write	Create and reply to tickets
   invoice:read	View invoices
   invoice:write	Generate invoices, mark paid

   Grant only the scopes your integration needs (principle of least privilege).

3. Store securely

   The token is shown once. Store it in a secrets manager or environment variable — never commit it to version control.

Using the token

Include it as a Bearer token on every request:

curl -s https://billing.openhost.one/api/admin/client/get_list \
  -H "Authorization: Bearer oh_live_abc123..." \
  -H "Accept: application/json"

Token format

Tokens are prefixed for identification:

Token rotation

Rotate tokens periodically and immediately after any suspected compromise:

1. Client area → API Credentials
2. Click Regenerate on the token
3. Update the token in your integration
4. Old token is invalidated immediately

Error responses

Example error body:

{
  "error": {
    "message": "Authentication Failed",
    "code": 401
  }
}

IP restrictions (optional)

For additional security, restrict a token to specific source IPs:

1. API Credentials → Edit token → Allowed IPs
2. Enter one IP or CIDR range per line
3. Requests from other IPs receive a 403

Recommended for production integrations running from a known server.

Client tokens vs. admin tokens

Best practices

• One token per integration — if one is compromised, revoke without breaking others
• Environment variables — store in OPENHOST_API_TOKEN, never hardcode
• Rotate on schedule — every 90 days minimum
• IP-restrict production tokens
• Log usage — monitor API calls for unexpected patterns
• Never expose tokens in frontend code, logs, or error messages

Related docs

• API overview
• Accounts API
• Webhooks