Hosting & server tools
Hosting credentials, customer access and passwords
Protect generated passwords and expose only supported, account-bound provider access actions.
About 2 min read
On this page
Credential vault
Supported provisioning generates and stores the account password encrypted under the installation's application key, bound to its exact connection, service, username and domain. Back up APP_KEY with the database and private storage. A new key cannot decrypt the existing vault. Do not put passwords into product descriptions, audit notes or public support attachments.
Reveal a credential
Customer reveal requires the verified owning account, service visibility, current password confirmation and the protected route's restrictions. Staff reveal uses its dedicated capabilities. An impersonated staff review is not a reason to bypass a customer's protected reveal. Downloads/reveal responses must stay private and noncached.
Temporary provider access
When the module implements ServiceAccess, the application can request a short-lived HTTPS provider sign-in URL for the exact mapped account. cPanel's native access flow checks the remote account before issuing access. A provider URL must not contain an administrator API token or a persistent master password. Availability of a Hosting servers connection does not promise SSO for every panel.
Password changes
Only modules implementing the optional password capability may expose remote password changes. Validate the service/account binding again before writing. A locally edited password field is not proof that the remote provider accepted it. Review the provider result and preserve uncertainty instead of telling the customer a password changed when it did not.
Diagnose unavailable controls
Check verified customer status, permissions, recent password confirmation, service state, exact provider mapping, enabled module/connection and optional capability. DirectAdmin and several other reviewed panel packages intentionally expose neither SSO nor password changes; use their supported provider workflow instead of fabricating buttons.