auth.php¶

Authentication and authorization module: session management, login via WHMCS, LDAP, API keys and SSO (Google, GitHub, VK), 2FA verification, SMS and email, as well as customer tag management.

API Methods¶

Method	Action	Description
`2fa_check`	verify 2FA code	Verifies the provided two-factor authentication (2FA) code to complete the login process.
`2fa_resend`	resend 2FA code	Triggers a new 2FA (Two-Factor Authentication) verification code to be sent to the user's registered contact method.
`billing_list`	get billing list	Returns a list of billing records or active services associated with the client, potentially filtered by location.
`email_check`	check email availability	Checks if a specific email address is already registered in the system to prevent duplicates.
`flip_tag`	flip_tag	Toggles the state of a specific tag for a given component.
`get_log`	get authorization log	Returns the authorization event log for a specified period or by token.
`get_log_details`	get log details	Retrieves detailed information about a specific authentication log entry using the provided token.
`github_init`	GitHub initialization	Initializes the GitHub authentication process.
`github_signin`	GitHub OAuth sign-in	Authenticates a user using GitHub OAuth credentials to establish a session.
`google_signin`	Google OAuth2 authentication	Authenticates a user via Google OAuth2 and establishes a session.
`info`	get authentication info	Retrieves information about the current authenticated session or client status.
`ipalogin`	FreeIPA authentication	Authenticates a user via FreeIPA and returns the associated roles and account information.
`login`	login	Authenticates a user via email and password, initiating a session and logging the attempt.
`logout`	logout	Terminates the current user session by invalidating the provided token.
`session_reset`	reset session	Resets the current user session, effectively logging out or invalidating existing session tokens.
`set_tag`	set tags	Mass inserts or updates tags for various components. Supports web icon assignment for presets.
`tg_verify`	Telegram verification	Verifies a user via Telegram authentication process.
`vk_init`	initialize vk session	Initializes a VK session or performs authentication-related setup.
`vk_signin`	VK sign-in	Authenticates a user via VKontakte social media integration.
`whmcslogin`	authenticate user via WHMCS or SSO	Authenticates a user using email/password or an SSO provider (Google, GitHub, VK). If multiple billing locations are found with valid credentials, it returns an async response to select the correct one. On success, returns a session token and user permissions.

auth/2fa_check¶

Verifies the provided two-factor authentication (2FA) code to complete the login process.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `2fa_check`
token	✅	string	Authentication token used for session verification.
params[code]	✅	string	The 2FA code provided by the user.

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=2fa_check" \
--data "token=HOSTKEY_TOKEN" \
--data "params[code]=VALUE"

Example of a successful response

{
"result": "OK",
"action": "2fa_check",
"data": {
"token": "abc123def456ghi789jkl012mno345pqr",
"expire": "2024-12-31T23:59:59Z"
}
}

Failure response

{
"code": -1,
"message": "Invalid 2FA code"
}

auth/2fa_resend¶

Triggers a new 2FA (Two-Factor Authentication) verification code to be sent to the user's registered contact method.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
token	✅	string	The current authentication token for the session.
params[user_id]	✅	int	The ID of the user for whom the 2FA code should be resent.
from	✅	string	Parameter `from`

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "token=HOSTKEY_TOKEN" \
--data "params[user_id]=VALUE" \
--data "from=VALUE"

Example of a successful response

{
"result": "OK",
"action": "2fa_resend",
"data": {
"status": "sent"
}
}

Failure response

{
"code": -1,
"message": "Invalid token or user not found"
}

auth/billing_list¶

Returns a list of billing records or active services associated with the client, potentially filtered by location.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `billing_list`
token	✅	string	Authentication token for API access.
params[location]	❌	string	Filter billing records by specific location code (e.g., 'NL', 'DE').

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=billing_list" \
--data "token=HOSTKEY_TOKEN"

Example of a successful response

{
"result": "OK",
"action": "billing_list",
"data": [
{
"userid": 123,
"currency_code": "EUR",
"corporate": false,
"email": "[email protected]"
}
]
}

Failure response

{
"code": -1,
"message": "Access denied or invalid token"
}

auth/email_check¶

Checks if a specific email address is already registered in the system to prevent duplicates.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `email_check`
params[email]	✅	string	The email address to check for existence.

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=email_check" \
--data "params[email][email protected]"

Example of a successful response

{
"result": "OK",
"action": "email_check",
"data": {
"exists": true,
"email": "[email protected]"
}
}

Failure response

{
"code": -1,
"message": "Invalid email format"
}

auth/flip_tag¶

Toggles the state of a specific tag for a given component.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
params[component]	✅	string	Component type (table name).
params[component_id]	✅	int\|array	ID or list of IDs for the component. If 0 - returns all possible tags/values.
params[tag]	✅	string	The name of the tag to flip.
token	✅	string	API authentication token

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "params[component]=VALUE" \
--data "params[component_id]=VALUE" \
--data "params[tag]=VALUE" \
--data "token=HOSTKEY_TOKEN"

Example of a successful response

{
"result": "OK",
"action": "flip_tag",
"data": {
"tags": [
{
"id": 123,
"name": "example_tag"
}
]
}
}

Failure response

{
"code": -1,
"message": "Error during tag operation"
}

auth/get_log¶

Returns the authorization event log for a specified period or by token.

HTTP-method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `get_log`
token	✅	string	Session token
user_token	❌	string	User token for log search
period_start	❌	string	Start of the period (YYYY-MM-DD)
period_stop	❌	string	End of the period (YYYY-MM-DD)
user_email	❌	string	User email for log filtering

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=get_log" \
--data "token=HOSTKEY_TOKEN"

Example of a successful response

{
"result": "OK",
"data": [
{
"id": 123,
"action": "login",
"ip": "1.2.3.4",
"time": "2024-01-15 10:00:00"
}
]
}

Failure response

{
"code": 404,
"message": "Log is empty"
}

auth/get_log_details¶

Retrieves detailed information about a specific authentication log entry using the provided token.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `get_log_details`
token	✅	string	Authentication token used to identify the session or user context.

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=get_log_details" \
--data "token=HOSTKEY_TOKEN"

Example of a successful response

{
"result": "OK",
"action": "get_log_details",
"data": {
"id": 12345,
"event": "login_success",
"ip": "192.168.1.1",
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"timestamp": "2024-05-20T14:30:00Z",
"status": "success"
}
}

Failure response

{
"code": -1,
"message": "Invalid token or log entry not found"
}

auth/github_init¶

Initializes the GitHub authentication process.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
-	-	-	No other parameters are available

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=github_init"

Example of a successful response

{
"result": "OK",
"action": "github_init",
"data": {}
}

Failure response

{
"code": -1,
"message": "Initialization failed"
}

auth/github_signin¶

Authenticates a user using GitHub OAuth credentials to establish a session.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `github_signin`
token	✅	string	GitHub OAuth access token obtained from the provider.
state	✅	string	Parameter `state`
code	✅	string	Parameter `code`

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=github_signin" \
--data "token=HOSTKEY_TOKEN" \
--data "state=VALUE" \
--data "code=VALUE"

Example of a successful response

{
"result": "OK",
"action": "github_signin",
"data": {
"expire": 1735689600,
"hash": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6",
"token": "abc123def456ghi789jklmno"
}
}

Failure response

{
"code": -1,
"message": "Authentication failed"
}

auth/google_signin¶

Authenticates a user via Google OAuth2 and establishes a session.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `google_signin`
token	✅	string	OAuth2 token received from Google provider.
credential	✅	string	Google OAuth2 credential string.

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=google_signin" \
--data "token=HOSTKEY_TOKEN" \
--data "credential=VALUE"

Example of a successful response

{
"result": "OK",
"action": "google_signin",
"data": {
"expire": 1735689600,
"hash": "a1b2c3d4e5f6g7h8i9j0",
"token": "abc123def456ghi789jkl"
}
}

Failure response

{
"code": -1,
"message": "Invalid Google token"
}

auth/info¶

Retrieves information about the current authenticated session or client status.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `info`
token	✅	string	Authentication token for the session.

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=info" \
--data "token=HOSTKEY_TOKEN"

Example of a successful response

{
"result": "OK",
"action": "info",
"data": {
"expire": "2025-12-31T23:59:59Z",
"hash": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6",
"token": "abc123def456ghi789jklmno"
}
}

Failure response

{
"code": -1,
"message": "Invalid token"
}

auth/ipalogin¶

Authenticates a user via FreeIPA and returns the associated roles and account information.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `ipalogin`
params[user]	✅	string	Auth username.
params[password]	✅	string	Auth password.

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=ipalogin" \
--data "params[user]=VALUE" \
--data "params[password]=VALUE"

Example of a successful response

{
"result": "OK",
"action": "ipalogin",
"data": {
"count": 0,
"email": "[email protected]",
"error": null,
"host": "ipa.example.com",
"path": "/cn=users,cn=accounts,dc=example,dc=com",
"roles": [
{
"id": 5,
"name": "admin"
}
],
"uid": 1001
}
}

Failure response

{
"code": -1,
"message": "Authentication failed"
}

auth/list_hashes¶

Returns a list of all existing authentication hashes.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `list_hashes`
-	-	-	No other parameters are available

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=list_hashes"

Example of a successful response

{
"result": "OK",
"action": "list_hashes",
"data": [
{
"hash": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6",
"expire": "2025-12-31T23:59:59Z",
"tags": [
{
"tag": "server_id",
"value": 123
}
]
},
{
"hash": "z9y8x7w6v5u4t3s2r1q0p9o8n7m6l5k4",
"expire": "2026-01-15T12:00:00Z",
"tags": []
}
]
}

Failure response

{
"code": -1,
"message": "Error retrieving hashes"
}

auth/login¶

Authenticates a user via email and password, initiating a session and logging the attempt.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `login`
params[email]	✅	string	User's email address used for authentication.
params[password]	✅	string	User's password.
key	✅	string	Parameter `key`
ttl	✅	string	Parameter `ttl`

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=login" \
--data "params[email]=VALUE" \
--data "params[password]=VALUE" \
--data "key=VALUE" \
--data "ttl=VALUE"

Example of a successful response

{
"result": "OK",
"action": "login",
"data": {
"token": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6",
"user_email": "[email protected]",
"web_ip": "192.168.1.1"
}
}

Failure response

{
"code": -1,
"message": "Invalid credentials"
}

auth/logout¶

Terminates the current user session by invalidating the provided token.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
token	✅	string	The authentication token to be invalidated.

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "token=HOSTKEY_TOKEN"

Example of a successful response

{
"result": "OK",
"action": "logout",
"data": {
"remote_addr": "192.168.1.1"
}
}

Failure response

{
"code": -1,
"message": "Invalid token"
}

auth/register¶

Registers a new client or account within the system.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
-	-	-	No other parameters are available

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=register"

Example of a successful response

{
"result": "OK",
"action": "register",
"data": {
"hash": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6",
"expire": 3600,
"token": "abc123def456ghi789jkl"
}
}

Failure response

{
"code": -1,
"message": "Registration failed"
}

auth/session_reset¶

Resets the current user session, effectively logging out or invalidating existing session tokens.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
token	✅	string	Authentication token for the current session.
confirm	✅	string	Confirmation parameter to prevent accidental logout.

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "token=HOSTKEY_TOKEN" \
--data "confirm=VALUE"

Example of a successful response

{
"result": "OK",
"action": "session_reset",
"data": {}
}

Failure response

{
"code": -1,
"message": "Invalid or expired token"
}

auth/set_tag¶

Mass inserts or updates tags for various components. Supports web icon assignment for presets.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
params[tags]	✅	`array<object>`	Array of tag objects to be processed. Each object must contain component, component_id, and tag. If the component is 'presets' and the tag name is one of [web_icon, web_icon_ru, web_icon_com], the value field must be a valid FontAwesome icon class from: fa-solid fa-server, fa-solid fa-microchip, fa-solid fa-memory, fa-solid fa-hard-drive, fa-solid fa-database, fa-solid fa-cloud, fa-solid fa-network-wired, fa-solid fa-globe, fa-solid fa-shield-halved, fa-solid fa-rocket, fa-solid fa-bolt, fa-solid fa-fire, fa-solid fa-gauge-high, fa-solid fa-cubes, fa-solid fa-layer-group, fa-solid fa-box, fa-solid fa-desktop, fa-solid fa-gamepad, fa-solid fa-snowflake, fa-solid fa-circle-nodes.
params[log_history]	❌	boolean	Whether to record the operation in the history log.
params[allow_update]	❌	boolean	If true, existing tags will be updated. If false and a duplicate tag is found, an error will be returned.
token	✅	string	API authentication token

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=set_tag" \
--data "params[tags][0][component]=presets" \
--data "params[tags][0][component_id]=123" \
--data "params[tags][0][tag]=web_icon" \
--data "params[tags][0][value]=fa-solid fa-server" \
--data "token=HOSTKEY_TOKEN"

Example of a successful response

{
"component": "presets",
"component_id": 123,
"error": null,
"internal": false
}

Failure response

{
"code": -1,
"message": "The field 'value' must be a supported website icon"
}

auth/sms_check¶

Verifies the provided SMS authentication code for a specific user or session.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `sms_check`
token	✅	string	Authentication token used to identify the session/user.
params[code]	✅	string	The SMS verification code provided by the user.

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=sms_check" \
--data "token=HOSTKEY_TOKEN" \
--data "params[code]=VALUE"

Example of a successful response

{
"result": "OK",
"action": "sms_check",
"data": {
"status": "verified",
"expire": "2024-12-31T23:59:59Z",
"hash": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"
}
}

Failure response

{
"code": -1,
"message": "Invalid SMS code"
}

auth/sms_send¶

Sends an SMS message to a specified phone number.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
params[phone]	✅	string	Recipient's phone number in international format (e.g., +1234567890).
params[message]	✅	string	The text content of the SMS message.
token	✅	string	API authentication token

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "params[phone]=VALUE" \
--data "params[message]=VALUE" \
--data "token=HOSTKEY_TOKEN"

Example of a successful response

{
"result": "OK",
"action": "sms_send",
"data": {
"status": "sent",
"message_id": 987654,
"timestamp": "2024-05-20T12:00:00Z"
}
}

Failure response

{
"code": -1,
"message": "Failed to send SMS"
}

auth/sms_validate¶

Validates the provided SMS code for a specific user or session to complete authentication.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `sms_validate`
params[code]	✅	string	The verification code received via SMS.
params[phone]	✅	string	The phone number associated with the authentication request.

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=sms_validate" \
--data "params[code]=VALUE" \
--data "params[phone]=VALUE"

Example of a successful response

{
"result": "OK",
"action": "sms_validate",
"data": {
"status": "verified",
"session_id": 12345,
"expires_at": "2024-05-20T12:00:00Z"
}
}

Failure response

{
"code": -1,
"message": "Invalid verification code"
}

auth/tg_verify¶

Verifies a user via Telegram authentication process.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `tg_verify`
token	✅	string	Authentication token for the session or request.

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=tg_verify" \
--data "token=HOSTKEY_TOKEN"

Example of a successful response

{
"result": "OK",
"action": "tg_verify",
"data": {
"status": "verified",
"user_id": 12345678,
"username": "telegram_user"
}
}

Failure response

{
"code": -1,
"message": "Invalid token or verification failed"
}

auth/track_sale¶

Records a sale event in the system, typically used for synchronizing billing or tracking transaction history.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `track_sale`
user_id	✅	int	Parameter `user_id`
invoice_id	✅	int	Parameter `invoice_id`
sum	✅	string	Parameter `sum`
token	✅	string	API authentication token

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=track_sale" \
--data "user_id=VALUE" \
--data "invoice_id=VALUE" \
--data "sum=VALUE" \
--data "token=HOSTKEY_TOKEN"

Example of a successful response

{
"result": "OK",
"action": "track_sale",
"data": {}
}

Failure response

{
"code": -1,
"message": "Error recording sale"
}

auth/unregister¶

Unregisters a specific tag from a component, effectively removing the association between an entity and a tag.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `unregister`
params[component]	✅	string	The component to which the tag belongs (e.g., 'presets').
params[component_id]	✅	int	The unique identifier of the component entity.
params[tag]	✅	string	The tag value to be removed. Supports wildcard '%' for pattern matching.

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=unregister" \
--data "params[component]=presets" \
--data "params[component_id]=123" \
--data "params[tag]=my_tag"

Example of a successful response

{
"result": "OK",
"action": "unregister",
"data": {
"component": "presets",
"component_id": 123,
"error": null,
"internal": false
}
}

Failure response

{
"code": -1,
"message": "Error during tag unregistration"
}

auth/validate¶

Validates the provided authentication credentials and returns a session or error status.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `validate`
params[login]	✅	string	Login identifier for the user account.
params[password]	✅	string	User password.

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=validate" \
--data "params[login]=VALUE" \
--data "params[password]=VALUE"

Example of a successful response

{
"result": "OK",
"action": "validate",
"data": {
"token": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6",
"user_id": 123,
"username": "john_doe",
"role": "admin"
}
}

Failure response

{
"code": -1,
"message": "Invalid credentials"
}

auth/validate_login¶

Validates user credentials and returns authentication status or error details.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `validate_login`
user	✅	string	Parameter `user`
password	✅	string	Parameter `password`

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=validate_login" \
--data "user=VALUE" \
--data "password=VALUE"

Example of a successful response

{
"result": "OK",
"action": "validate_login",
"data": {
"status": "success",
"user": {
"id": 123,
"email": "[email protected]",
"role": "admin"
},
"token": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"
}
}

Failure response

{
"code": -1,
"message": "Invalid credentials"
}

auth/vk_init¶

Initializes a VK session or performs authentication-related setup.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `vk_init`
state	✅	string	Parameter `state`

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=vk_init" \
--data "state=VALUE"

Example of a successful response

{
"result": "OK",
"action": "vk_init",
"data": {}
}

Failure response

{
"code": -1,
"message": "Initialization failed"
}

auth/vk_signin¶

Authenticates a user via VKontakte social media integration.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
action	✅	string	Method identifier: `vk_signin`
token	✅	string	VK authentication token received from the provider.
state	✅	string	Parameter `state`
code	✅	string	Parameter `code`
device_id	✅	int	Parameter `device_id`

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "action=vk_signin" \
--data "token=HOSTKEY_TOKEN" \
--data "state=VALUE" \
--data "code=VALUE" \
--data "device_id=12345"

Example of a successful response

{
"result": "OK",
"action": "vk_signin",
"data": {
"user_id": 12345678,
"name": "John Doe",
"email": "[email protected]",
"avatar_url": "https://sun9.api.vk.com/photo-123_abc.jpg"
}
}

Failure response

{
"code": -1,
"message": "Invalid VK token"
}

auth/whmcslogin¶

Authenticates a user using email/password or an SSO provider (Google, GitHub, VK). If multiple billing locations are found with valid credentials, it returns an async response to select the correct one. On success, returns a session token and user permissions.

HTTP Method: POST

Parameters:

Parameter	Required	Type	Description
sso	❌	string	SSO provider used for authentication. Allowed values: google, github, vk.
sso_hash	❌	string	The SSO token or hash provided by the third-party service.
user	✅	string	User's email address for traditional login. Must be a valid email format and ASCII encoded.
password	✅	string	User's password for traditional login.

Example Request

curl -s "https://invapi.hostkey.com/auth.php" -X POST \
--data "user=VALUE" \
--data "password=VALUE"

Example of a successful response

{
"token": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0",
"role": "Customer",
"role_type": "Customer",
"whmcs_id": 123,
"whmcs_location": "US",
"whmcs_token": "",
"permissions": [
"manageproducts",
"show_invoices",
"edit_master_profile"
],
"corporate": 0,
"verified": "",
"token_expire": 1735689600,
"new": 1,
"country": "United States",
"country_code": "US",
"currency_code": "USD",
"vat": "12.34",
"VisitorID": "visitor_abc_123",
"prebill": true,
"prebill_scope": "all",
"prebill_global": true,
"tags": [
{
"tag": "role_id",
"value": 6,
"extra": "whmcs_login:221 123456"
}
],
"billing_options": {
"location": "US",
"company": "Example Company"
},
"client_data": {}
}

Failure response

{
"code": -2,
"message": "Invalid credential"
}