Module and release scope
This guide covers Froxlor Hosting Control Panel 1.0.0, Extension API 1, from the reviewed product source. Its declared core range is 1.3.6–1.3.99. Use the matching released core and signed provider package; a version label alone does not install the required contracts. Source availability does not mean the module is bundled in every currently downloadable product, installed on your server, enabled or certified for your merchant/server account. Nothing in this guide enables a provider or changes your existing connections.
Open System → Hosting servers (newer source may group these as Payments, Domain services or Hosting services). Install the reviewed signed package through Modules & addons or the integration workspace's Install tab, enable the module separately, add an account/connection, save its own credentials, run its stated Test and explicitly enable the connection. Saving or retesting disables the connection until you enable it again. Start with the provider's test environment where supported; otherwise use an isolated account or server.
Exact connection fields
These are the fields declared by this module. Secret values are entered privately and encrypted by the application. Defaults are configuration hints, not approved live merchant settings. Internal fields are populated by the module and are not operator-editable.
| Key / label | Type | Required | Default / guidance |
|---|---|---|---|
host — Panel hostname or IP |
text | Yes | Hostname or IP only. HTTPS and certificate verification are required. |
port — HTTPS port |
integer | No | Default: 443 |
api_key — API key |
secret | Yes | Use the account-specific value described below. |
api_secret — API secret |
secret | Yes | Use the account-specific value described below. |
default_nameservers — Default nameservers |
text | No | Comma or space separated hostnames. |
allow_writes — Allow account changes |
boolean | No | Default: false |
automation — Allow automatic provisioning |
boolean | No | Default: false |
allow_automated_suspend — Allow automatic suspension |
boolean | No | Default: false |
allow_automated_unsuspend — Allow automatic unsuspension |
boolean | No | Default: false |
allow_automated_terminate — Allow automatic termination |
boolean | No | Default: false |
API 1 server module for the documented Froxlor 2.3 API. Installed disabled with no operator credentials, connection, hosting accounts or business settings. Froxlor's developing v3 API is not covered.
Configure
- In Froxlor enable Settings → System settings → Enable external API usage. Create an administrator/reseller API key and secret from the account menu → API keys. Restrict the key to the billing server's source IP and appropriate expiry.
- Ensure the account can list/manage customers, domains and hosting plans. If using Apache with PHP-FPM, configure Froxlor's documented
CGIPassAuth On/ authorization header passing option. - Enable this module and create a Hosting servers connection. Enter the plain panel hostname/IP, HTTPS port (normally 443), key and secret. This integration calls the fixed root path
/api.php, so use a Froxlor virtual host served at its own hostname. Subdirectory installations must be exposed on a dedicated virtual host; arbitrary API path entry is intentionally unavailable. - Use a valid TLS certificate. All Froxlor commands are HTTPS POST requests with JSON command/params and HTTP Basic key/secret authentication. The test invokes read-only listing commands even though the transport method is POST.
- Create plans in Froxlor first, test credentials and explicitly refresh package inventory. Products select the exact numeric plan ID. The owning customer's actual company or first and last name is required by Froxlor; missing identity fails before account submission.
- Configure default nameservers as needed. Account changes and each automatic lifecycle action require separate opt-in and are all disabled by default. Ensure the Froxlor system cron runs correctly.
Supported lifecycle and confirmation
Creates a shared hosting customer with the reserved username/password, applies its plan and creates its owned domain. Also supports read/synchronization, suspension, unsuspension, applying another plan's resource values and deleting the customer/resources. Reseller creation and VPS/server lifecycle are excluded.
Froxlor copies plan resource settings into the customer rather than exposing a persistent plan assignment. The module compares those returned settings against the selected plan, including provider storage units and allowed PHP configuration IDs. Missing or different limits are not confirmed. Suspension disables IMAP/POP3 as part of Froxlor's behaviour; those two temporarily disabled flags are excluded from the suspended-account plan comparison. Changing a plan in Froxlor does not automatically update previously copied customer limits.
Customer creation and domain creation are separate writes. If only one succeeds, the reserved account stays unconfirmed and requires review. Username and domain duplicates are blocked before creation; timeouts never trigger an automatic retry. API errors are redacted and cannot disclose keys, credentials or customer contacts.
A confirmed result means fresh API reads matched the exact customer login, owned domain, requested resource settings and active/suspended control-panel state. Froxlor schedules home-directory creation and webserver/DNS changes through its server cron. Its public API does not expose those runtime task results; runtime_status is not_exposed. Do not interpret account confirmation as a certificate that cron jobs, DNS propagation or public website delivery have finished. Check the Froxlor job queue/server logs for delivery issues. An explicit HTTP 202 response remains pending.
No webhook is needed. Test credentials reads only; use a dedicated test panel for write acceptance testing. Responses are limited to 2 MiB, TLS verification is mandatory, compression/redirects are refused and writes are never retried.
Provider documentation
- API setup, authentication and response structure
- Customers API
- Domains API
- Hosting plans API
- Vendor 2.3.16 customer implementation
Termination also requires a fresh API read showing that the exact remote hosting account is suspended. A local billing status alone does not authorize deleting an active remote account.