A WHMCS reseller hosting setup connects WHMCS to a cPanel and WHM reseller account with an API token, uses WHM packages named with your reseller username as a prefix, links each package to a Shared Hosting product, and brands cPanel through WHM's Customization interface. Selling reseller accounts of your own is a different product type, Reseller Hosting, and needs root on the server.
Which kind of reseller hosting are you running?
There are two, and WHMCS treats them differently. Most new hosting brands rent a reseller account and sell cPanel accounts inside it. A brand that owns a server can also sell reseller accounts to other people. The WHMCS cPanel module page describes both:
| You rent a reseller account | You sell reseller accounts | |
|---|---|---|
| What the customer gets | A cPanel account | A WHM reseller account |
| WHMCS Product Type | Shared Hosting | Reseller Hosting |
| WHM Package Name | An existing package, named username_packagename | Left empty; limits set in Advanced Mode |
| Access you need | Reseller privileges and an API token | Root, and a token with the Everything permission |
| Per-account quotas without a package | Not possible, root only | Possible |
What should you ask the upstream provider for?
Ask for the WHM privileges WHMCS needs, in writing, before you pay. A provider controls them in WHM's Edit Reseller Nameservers and Privileges interface, which the cPanel documentation lists by name.
- API tokens. The Manage API Tokens privilege (
manage-api-tokens). The tokens table only appears when all Initial Privileges are enabled. - Account actions. Create, suspend and unsuspend, terminate, upgrade or downgrade, change passwords and list accounts.
- Packages. List, add and edit packages, so you can build your own plans.
- Nameservers and branding. Nameserver configuration and access to the Customization interface. Both can be switched off for resellers.
- Limits. Which account limit applies to you: a total number of accounts, disk and bandwidth totals, or specific packages. Ask whether overselling is allowed, because without it your package quotas cannot add up to more than your allocation.
- Network. Outbound connections from your WHMCS server to ports 2086 and 2087, and API requests not blocked by a two-factor policy. Only root can change that policy.
How do you connect WHMCS to a WHM reseller account?
Create an API token in WHM and add it to WHMCS as a cPanel server. In WHM, go to Development » Manage API Tokens, as described in Manage API Tokens in WHM:
- Name the token with letters, numbers, dashes or underscores.
- Choose whether it expires. An expired token is not deleted, it just stops working, and provisioning stops with it. If you set a date, put it in your calendar.
- Enter your WHMCS server's IP address in IPs, so the token is useless anywhere else.
- Keep only the privileges WHMCS uses. The cPanel module page lists them:
basic-whm-functions,basic-system-info,cpanel-api,create-acct,create-user-session,suspend-acct,upgrade-account,kill-acct,passwd,acct-summary,list-accts,show-bandwidth,cpanel-integration,list-pkgs,ns-config,edit-mx,manage-api-tokensandssl-gencrt. - Click Generate and save the token at once. WHM does not show it again.
In WHMCS, go to Configuration > System Settings > Servers, click Add New Server and select cPanel. Enter the hostname, your WHM reseller username and the token, click Test Connection, fill in the server details and click Save Changes. If it is your only cPanel server, click its name so an asterisk marks it as the default. My WHMCS cPanel integration guide covers connection errors.
How do you map WHM packages to WHMCS products?
Build every plan as a WHM package first, then point a WHMCS product at it. In WHM, use Packages » Add a Package. A package you create as a reseller gets your username and an underscore in front of its name, which is how WHM tells reseller packages from global ones.
In WHMCS, go to Configuration > System Settings > Products/Services, create the product with Product Type set to Shared Hosting, open Module Settings, choose cPanel and select the package from WHM Package Name. Pick it from the menu rather than typing it. The menu only lists packages your reseller account can still provision; a package that would exceed your quotas is left out, and WHM's Create a New Account page shows it with a "Cannot use due to limits" error.
Do not leave WHM Package Name empty and use Advanced Mode on a reseller account. Per-account quotas need root, so that only works for the second model.
What happens during provisioning, and what usually fails?
WHMCS creates, suspends, unsuspends and terminates accounts, changes packages and passwords, updates usage and gives a cPanel login link, all through the WHM API. When a call fails, the message appears in the Module Log at Configuration > System Logs, and failed automatic actions wait at Utilities > Module Queue. These are the errors that point at a reseller setup, with the causes WHMCS documents:
| Error | Documented cause |
|---|---|
| Package Not Allowed or Exceeded Resource/Account Allocation | Reseller-only access and no valid package name on the product |
| You do not have permission to use Selected Package | The package name in WHMCS does not exactly match WHM's username_packagename |
| Product attribute Package Name XXX not found on server | Not enough resources left, a mistyped name, or a token missing permissions |
| Resellers are not permitted to create subdomains of the server's main domain | The service has no domain set |
| Sorry, that username is reserved | The generated username contains a prohibited word |
The Package Permission Errors page has the exact fix for the most common one.
If accounts already exist in WHM, Sync Accounts on the Servers page imports them. Read the report before you confirm: a ticked service that exists in WHMCS but not on the server is set to Terminated.
How do you brand cPanel and your nameservers?
Use WHM's Customization interface, if the provider has enabled it for you. Per the Customization page, it changes the cPanel interface only, not WHM:
- Logos in SVG format, one for light and one for dark backgrounds.
- The Main Menu color.
- A favicon in ICO format.
- The Help and Documentation links in the footer.
- The company name and contact URL on the default and suspended website pages.
For private nameservers, register ns1 and ns2 host records on your domain at your registrar, then set them under Explicitly Set the Nameservers in Edit Reseller Nameservers and Privileges, with A records from Configure Address Records. If the provider has not given you that interface, they have to do it, and the nameserver IP addresses must already exist on the server.
The cPanel login link that WHMCS shows customers uses the hostname in the server record, or the IP address if there is none. A hostname of your own only works if the server has a valid certificate for it, which is the provider's decision.
How do you sell reseller accounts from your own server?
Create a product with Product Type set to Reseller Hosting, leave WHM Package Name empty and click Switch to Advanced Mode. Enter the quotas, an existing WHM ACL list in Reseller ACL List, and the limits: Limit Reseller by Number or by Usage, Reseller Disk Space and Bandwidth, the two overselling options, Configure Nameservers and Reseller Ownership. The API token needs Everything, which equals root, so restrict it to your WHMCS IP.
To charge per cPanel account the reseller creates, follow Bill Resellers Per Account: on the Reseller Hosting product, turn Sub-Accounts on under Metric Billing and set the pricing per unit, by volume or with a number of accounts included. WHMCS counts the accounts on the next due date and adds the charge to the renewal invoice. It recommends this on monthly billing cycles.
What are the limits and risks of reseller hosting on WHMCS?
You control billing and accounts, not the server. Without root you cannot change PHP versions server-wide, tune MySQL, set per-account quotas outside a package or decide the backup policy. The risks I plan for:
- Shared fate. One abusive customer can get your whole reseller account suspended. Fraud checks and a fast suspension policy matter more here than on your own server.
- Overselling. If the provider allows it, your quotas can promise more than the server delivers.
- Token scope. A token with Everything is root. Restrict its IPs and treat it like a root password.
- Silent expiry. An expiring token or a provider who changes your privileges stops provisioning until you notice the Module Log.
- Lock-in. Moving to your own server later is a migration of every account and its DNS. Plan it before you need it.
For the WHMCS install itself, see how to set up WHMCS, and for the business side, starting a hosting business. When a provider's panel or a billing rule needs code that WHMCS does not ship, that is custom module development work I take on.
Last reviewed 12 October 2026. Disclosure: I sell WHMCS and web development work, so I am not neutral. I am CTO at ElySpace, a freelance developer for Marmaids LLC, and founder of WHMCSPilot and MagizAI.
