Required contracts
A server module implements ServerModule::execute. The newer HostingControlPanel adds availablePackages(connection) and candidateUsername(service). Use the matching released core; a module requiring this interface cannot run merely because an older application's display version falls in its manifest range.
Inventory must return the exact packages the credential can create and enough account identity/state to detect duplicates. candidateUsername must be stable and match that panel's rules; a collision must not silently select a fresh identity after an uncertain create.
Account binding
Before remote creation, the core validates the active owning customer, paid uncancelled service, exact product/server and package. Persist the selected username and encrypted password binding before the provider request. Inspect both existing primary domain and username in the credential's full relevant scope.
Support only explicit actions such as create, sync/info, suspend, unsuspend, change_package and terminate. Do not expose arbitrary API commands or shell execution. After any mutation, read the exact username/domain/package/state back; missing confirmation yields pending, not invented success. Deletion needs the separately enabled lifecycle policy and remotely confirmed suspended account.
Optional customer features
Implement ServiceAccess only when the provider can issue an account-bound short-lived HTTPS sign-in URL without exposing an administrator token. Implement ServicePassword only with fresh exact-account verification and real remote acceptance. Do not advertise SSO/password changes simply because another server module supports them.
Transport and tests
Require plain HTTPS origins, trusted TLS, no redirects, explicit timeouts, response-size/encoding limits and sanitised errors. Restrict credentials to intended commands, account scope and source IP where the provider supports it. Test duplicate-domain/username, removed package, incomplete inventory, unsupported product, timeout after write, wrong readback and forbidden lifecycle capability. A dedicated expendable provider server is required for actual external acceptance.