n8n-nodes-whm

A community node package that brings cPanel & WHM (WebHost
Manager) into n8n as native nodes.

It ships two nodes:

• WHM — an action node covering the server-level WHM API (accounts, packages,
  domains, DNS zones, resellers, server, services, SSL, backups, API tokens) and
  the account-level cPanel API (email accounts, MySQL databases, addon/parked/sub
  domains, FTP accounts) executed as any cPanel user through WHM — no per-account
  passwords needed. Two escape hatches (Custom WHM Call and cPanel Function) can
  invoke any documented WHM API 1, UAPI or API 2 function.
• WHM Trigger — a webhook node that starts workflows from WHM hook events
  (account created, suspended, email account added, …) via a small, signed hook
  bridge script that you register on the server.

Design, endpoint, authentication and workflow details live in
WHM-n8n-Node-Technical-Documentation.md.

Installation

Via the n8n UI (recommended)

1. In n8n go to Settings → Community Nodes → Install.
2. Enter n8n-nodes-whm and confirm.

Manual / self-hosted

cd ~/.n8n/nodes        # or your N8N_CUSTOM_EXTENSIONS path
npm install n8n-nodes-whm

Build from source

git clone https://github.com/Falcyn/n8n-nodes-whm.git
cd n8n-nodes-whm
npm install
npm run build      # tsc + copies icons into dist/
npm run lint       # eslint with eslint-plugin-n8n-nodes-base

The compiled output in dist/ is what n8n loads (see the n8n block in package.json).

Credentials

Create an API token in WHM first:

1. WHM » Development » Manage API Tokens » Generate Token.
2. Give it a name and restrict its privileges (ACLs) to what your workflows need. A
   reseller can generate a token limited to its own accounts.
3. Copy the token — WHM shows it only once.

Then in n8n add a WHM API credential:

The credential Test button calls the harmless version function.

HashiCorp Vault mode

WHM API tokens are all-or-nothing, so keeping them out of n8n is worth doing. Set
the node's Authentication to HashiCorp Vault and it reads the host and
token from Vault on every execution instead of from an n8n credential. The
Server field picks which WHM server, and it accepts an expression, so a single
node can reach any server (for example {{ $json.server_id }}).

One secret per server in a KV engine, at <KV Mount>/<Path Prefix>/<Server>:

vault kv put secret/n8n/whm/main host=https://whm.example.com:2087 token=THE_TOKEN user=root

Then add a WHM (HashiCorp Vault) API credential: Vault URL, AppRole
(Role ID + Secret ID) or a token, KV mount, KV version and path prefix (n8n/whm
for the example above). Its Test button logs in and lists the servers it can
see. A minimal read-only policy:

path "secret/data/n8n/whm/*"     { capabilities = ["read"] }
path "secret/metadata/n8n/whm/*" { capabilities = ["list", "read"] }
path "secret/metadata/n8n/whm"   { capabilities = ["list"] }   # only for the credential Test
path "auth/token/revoke-self"    { capabilities = ["update"] }

Per execution the node logs in once (AppRole), reads each distinct server's
secret once, and revokes its own token when it finishes, even if an item
fails. A static token set in the credential is used as-is and never revoked.
The server name must be letters, digits, ., - or _, so an expression cannot
walk to another Vault path. The WHM token never appears in the node's output.
Rotating a token is a vault kv put; nothing in n8n changes.

What the WHM node can do

Every operation also has a Custom Parameters list for parameters that are not
exposed as fields, and an Options → Raw Response switch that returns the
complete API envelope. Get Many operations support Return All / Limit and, for
WHM API 1 functions, server-side Filters and Sort (api.filter.*, api.sort.*).

Trigger setup (optional)

cPanel & WHM has no outbound webhooks; it has Standardized Hooks that run a script
when something happens. The package ships that script.

1. Add a WHM Trigger node, pick the events, set a Shared Secret, and copy the
   Production URL.
2. Copy the bridge/ folder to the WHM server and run, as root:

   ./n8n-whm-hooks.sh install --url https://n8n.example.com/webhook/<id>/whm --secret '<same secret>'
   

   This installs /opt/n8n-whm-hook-bridge/n8n-whm-hook-bridge.pl, writes
   /etc/n8n-whm-hook-bridge.conf (root-only) and registers a default set of events
   with manage_hooks.
3. Register extra events with ./n8n-whm-hooks.sh add <Category> <Event> [pre|post],
   e.g. ./n8n-whm-hooks.sh add Cpanel UAPI::Email::passwd_pop post. Add the same
   name to the node's Custom Events if it is not in the list.

The bridge reads the hook's JSON from STDIN, redacts password fields, signs the body
with HMAC-SHA256 (X-WHM-Signature) and POSTs it to n8n with a short timeout. It
always reports success to cPanel, so an unreachable n8n never blocks account
creation or any other WHM action. Delivery failures are logged to
/usr/local/cpanel/logs/n8n-whm-hook-bridge.log.

Quick examples

Create a hosting account when an order comes in:

• Resource Account → Operation Create
• Username {{ $json.username }}, Domain {{ $json.domain }}
• Additional Fields → Package starter, Contact Email {{ $json.email }}

List every suspended account owned by reseller acme:

• Resource Account → Get Many
• Filters → Search Type Owner, Search ^acme$
• List Options → Filters → Field suspended, Type Equals, Value 1

Add a mailbox on a customer's account:

• Resource cPanel Email → Create
• cPanel Username examplecom, Email Address support@example.com, Password …

Security

• Use API tokens, not passwords, and restrict their ACLs. A root token can do
  anything on the server; a reseller token can only touch that reseller's accounts.
• Always set a Shared Secret on the WHM Trigger. Without it the webhook is
  unauthenticated and anyone who discovers the URL can inject fake events. The node
  verifies an HMAC-SHA256 signature over the raw body in constant time.
• Hook payloads can contain passwords (account creation, password changes). The
  bridge redacts common password keys before the event leaves the server; extend the
  redact list in the config if you register other events.
• Use HTTPS end to end. Point the bridge at an https:// n8n URL and keep
  Ignore SSL Issues off once WHM has a valid certificate.
• Credentials are stored in n8n's encrypted credential store, injected per request
  as an Authorization header, and redacted from error output by the node.

Disclaimer

This is an unofficial, community-maintained project. It is not affiliated with,
endorsed by, or sponsored by cPanel, L.L.C. or WebPros. "cPanel" and "WHM" are
trademarks of cPanel, L.L.C. and are used here only to describe API compatibility. This
package contains no cPanel source code — it communicates with WHM solely through
its public, documented APIs and hook system. The software is provided "as is", without
warranty of any kind (see LICENSE).

License

MIT © Anthony Tuberville