Select the matching core and panel package
The reviewed newer source provides the HostingControlPanel capability for several separately signed panel modules; the older published source has its existing guarded cPanel path. Use the exact matching core update and package from the provider directory. A product category called VPS or dedicated does not implement a virtual-machine API.
Prepare delivery
Configure the server privately, test its read-only account/package inventory and explicitly enable it. Permit writes only after isolation/recovery testing. Map the product to automatic or manual fulfilment and an exact package visible to that account. Confirm customer email, domain, nameservers and paid invoice. Additional lifecycle permissions for automated suspend/restore/termination remain separate and default closed.
Creation and confirmation
A stable username is reserved before remote create. Duplicate-domain/username checks, the current package inventory, customer/service binding and encrypted generated-password vault protect the operation. Provider submission is recorded durably. A fresh exact read must confirm username, primary domain, package and state; API acceptance alone leaves the service pending when confirmation is missing.
Do not choose a new random username, change servers or retry create after a timeout. Inspect the same reserved account on the assigned panel and use supported synchronization/reconciliation. A duplicate found remotely needs review, not automatic adoption of somebody else's account.
Ongoing actions
Supported actions depend on the selected module: sync/info, suspend, explicit unsuspend, package change and protected termination. Temporary sign-in/password changes exist only where the module implements their optional contracts. A generic panel connector must not advertise unsupported SSO or arbitrary remote commands. Open the relevant provider-specific guide for its exact privileges and limitations.
Validate
Use a dedicated test panel with an expendable account. Test both expected confirmation and a simulated uncertain provider response, restricted credentials, existing username/domain, removed package and forbidden product type. Local mocked tests do not prove the installed root server or production token has these permissions.