n8n-nodes-whmcs

A community node package that brings the WHMCS billing &
automation API into n8n as native nodes.

It ships two nodes:

• WHMCS — an action node covering Clients, Orders, Invoices, Products/Services,
  Tickets, Domains and System operations, plus a Custom API Call escape hatch that
  can invoke any of the 200+ documented WHMCS actions.
• WHMCS Trigger — a webhook node that starts workflows from WHMCS hook events
  (new order, invoice paid, ticket opened, …) via a small PHP bridge file.

Full design, endpoint, authentication and workflow documentation lives in
WHMCS-n8n-Node-Technical-Documentation.md
(in the parent folder).

Installation

Via the n8n UI (recommended)

1. In n8n go to Settings → Community Nodes → Install.
2. Enter n8n-nodes-whmcs and confirm.

Manual / self-hosted

cd ~/.n8n/nodes        # or your N8N_CUSTOM_EXTENSIONS path
npm install n8n-nodes-whmcs

Build from source

git clone https://github.com/Falcyn/n8n-nodes-whmcs.git
cd n8n-nodes-whmcs
npm install
npm run build      # tsc + copies icons into dist/
npm run lint       # eslint with eslint-plugin-n8n-nodes-base

The compiled output in dist/ is what n8n loads (see the n8n block in package.json).

Credentials

Create an API credential in WHMCS first:

1. Configuration → System Settings → Manage API Credentials → Generate New API Credential.
2. Pick an admin role that has the API Access permission.
3. Copy the Identifier and Secret (the secret is shown only once).

Then in n8n add a WHMCS API credential:

The credential Test button calls the harmless WhmcsDetails action to confirm the
identifier/secret and IP/access-key configuration.

Trigger setup (optional)

1. Add a WHMCS Trigger node and copy its Production URL.
2. Copy bridge/whmcs-hook-bridge.php into your WHMCS includes/hooks/ directory.
3. Edit the file: set $n8nWebhookUrl to the Production URL, optionally set
   $sharedSecret, and list the events in $forwardEvents.
4. Set the same secret in the node's Shared Secret field.

Quick example

Get every unpaid invoice for client 42:

• Resource Invoice → Operation Get Many
• Filters → Client ID 42, Status Unpaid

Security

This node talks to your billing system and the trigger receives inbound HTTP, so a
few settings are security-relevant:

• Always set a Shared Secret on the WHMCS Trigger. If you leave it blank the
  webhook is unauthenticated — anyone who discovers the URL can inject fake
  events (e.g. a forged InvoicePaid). Set a long random secret in the node and the
  matching $sharedSecret in whmcs-hook-bridge.php. The node compares secrets in
  constant time.
• Use HTTPS end to end. WHMCS hook payloads can contain client and invoice PII.
  The PHP bridge should point $n8nWebhookUrl at an https:// URL so that data —
  and the shared secret header — is never sent in clear text.
• Keep "Ignore SSL Issues" off. Only enable it for trusted internal/staging
  hosts; disabling certificate validation exposes API traffic to interception.
• Scope the WHMCS API role. Generate the API credential against an admin role
  granted only the permissions your workflows actually use, and restrict by IP under
  Setup → General Settings → Security where possible. Prefer IP allow-listing over
  the Access Key, which bypasses it.
• Credentials are stored in n8n's encrypted credential store and injected per
  request; they are never logged by the node, and credential values are redacted from
  error output.

Disclaimer

This is an unofficial, community-maintained project. It is not affiliated with,
endorsed by, or sponsored by WHMCS Limited. "WHMCS" is a trademark of WHMCS Limited
and is used here only to describe API compatibility. This package contains no WHMCS
source code — it communicates with WHMCS solely through its public, documented API.
The software is provided "as is", without warranty of any kind (see LICENSE).

License

MIT © Anthony Tuberville