API tokens

API tokens let scripts, CI/CD or external tools call the MyPanel API without a password or 2FA. This is a Pro feature.

Create a token

Go to Settings → Account → API token:

1. Enter a memorable name (e.g. ci-deploy).
2. Click Create token.
3. Copy the token shown — it looks like mpat_….

Shown only once

MyPanel stores only a hash of the token, never the raw value. Once you close the dialog you can’t see it again — if lost, revoke it and create a new one.

Usage

Send the token in the Authorization header:

curl -H "Authorization: Bearer mpat_xxxxxxxx" https://panel.example.com/api/sites

See the Automation API page for the endpoint list.

Security

• A token has full admin rights — treat it like a root password.
• Do not commit tokens to git; keep them in environment variables / CI secrets.
• Revoke unused tokens immediately under Settings → Account → API token (delete button).
• Each token shows its last-used time so you can spot forgotten tokens.