https://docs.whmcs.com/9-1/tags/authentication/Recent content in authentication onHugo -- gohugo.iohttps://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/troubleshooting-authentication/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/troubleshooting-authentication/Lists linked troubleshooting articles grouped by category, including general WHMCS authentication issues, Facebook, Google, and Twitter Sign-In Integration errors, password reset problems, and two-factor authentication issues.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-licensing/troubleshooting-licensing/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-licensing/troubleshooting-licensing/Serves as an index of licensing error troubleshooting articles and points to separate guides for the cPanel Licensing Addon and control panel licensing issues within hosting modules.https://docs.whmcs.com/9-1/system/authentication/two-factor-authentication/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/authentication/two-factor-authentication/Compares the three 2FA services (Time-Based Tokens, Duo Security, YubiKey), lists where clients and admins configure 2FA, covers server-clock-mismatch error messages, and links troubleshooting articles for common 2FA issues.https://docs.whmcs.com/9-1/system/authentication/duo-security/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/authentication/duo-security/Explains retrieving the Duo Client ID, Client Secret, and API hostname from the Duo Security admin portal to configure it at Configuration > System Settings > Two Factor Authentication, the admin email/license-key format Duo uses, and how to reactivate a user’s 2FA after a lost device.https://docs.whmcs.com/9-1/clients/client-management-tutorials/reset-a-user-password/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/clients/client-management-tutorials/reset-a-user-password/Explains the self-service password reset flow via Forgotten Password on the login form, the two-hour validity of the confirmation link, and the SQL query against tblusers to force a reset on a self-hosted installation by clearing a user’s password and token fields.https://docs.whmcs.com/9-1/clients/client-management-tutorials/set-a-user-password-manually/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/clients/client-management-tutorials/set-a-user-password-manually/Gives steps to manually set a user’s password from the Users tab of the client profile by selecting Change Password from the Actions column dropdown, entering the new password, and clicking Save.https://docs.whmcs.com/9-1/system/authentication/api-credentials/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/authentication/api-credentials/Details the steps to create, edit, and delete API roles and API credential pairs at Configuration > System Settings > Manage API Credentials, including generating identifier/secret pairs and assigning permission roles to a credential.https://docs.whmcs.com/9-1/system/authentication/single-sign-on/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/authentication/single-sign-on/Details the View Products & Services and Perform Single Sign-On permissions required by users, per-server per-admin-role-group access controls configurable under a server’s SSO Access Control setting, and the Client Area Quick Shortcuts section for direct control panel authentication.https://docs.whmcs.com/9-1/system/authentication/application-links/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/authentication/application-links/Covers activating and configuring Application Links for cPanel, the supported Ordering, Support, and Account links table, the Application Link Activity Log levels (Debug, Information, Notice, Warning), and where users and admins can revoke single sign-on permissions.https://docs.whmcs.com/9-1/system/authentication/sign-in-integrations/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/authentication/sign-in-integrations/Explains activating a Facebook, Google, or Twitter sign-in provider with API credentials at Configuration > System Settings > Sign-In Integrations, where users manage linked accounts under Profile > Security Settings, and where sign-in errors log in the Activity Log.https://docs.whmcs.com/9-1/system/authentication/openid-connect/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/authentication/openid-connect/Covers generating and resetting OAuth Client API Credentials and authorized redirect URIs at Utilities > System > OpenID Connect, and gives the full step-by-step setup to let cPanel & WHM users log in via WHMCS External Authentication, including the Well Known Config URI and SSL requirements.https://docs.whmcs.com/9-1/system/authentication/openid-connect-development/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/authentication/openid-connect-development/Documents the developer workflow for OpenID Connect authentication against WHMCS: the .htaccess rewrite rule for the discovery document, the client_id/response_type/scope/redirect_uri/state authentication request parameters, exchanging the authorization code for access_token and id_token, and the iss/sub/aud/iat/exp ID token claims.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/cloudflare-proxy-check-errors/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/cloudflare-proxy-check-errors/Covers the System Health CloudFlare Proxy Check warning about missing trusted proxy settings that can end login sessions prematurely, and gives the one-click fix: click the reconfigure link to add Cloudflare’s IP addresses to the Trusted Proxies list in General Settings’ Security tab.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/frequent-logouts/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/frequent-logouts/Diagnoses frequent logouts by cause: PHP session misconfiguration (checked via System Health), proxy/CDN misconfiguration breaking IP detection, insufficient disk space, changing visitor IPs, or VPN use, with workarounds like disabling Session IP Check or using database session storage.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-licensing/invalid-license-api-errors/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-licensing/invalid-license-api-errors/Explains that the Your license key is invalid API error occurs when a license check runs from a non-web context like a CLI script or cron with a mismatched outbound IP, with steps to confirm the context, calling method, and IP mismatch, and recommending remote HTTP requests to api.php instead of the localAPI helper.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-licensing/invalid-license-errors/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-licensing/invalid-license-errors/Covers the License Invalid error at Admin Area login caused by an incorrect license key in configuration.php or an unreissued license after moving the installation, with steps to verify the $license value against the issued key and reissue it via Services > My Licenses or through the hosting provider.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/login-details-errors/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/login-details-errors/Covers the Client Area error “Login Details Incorrect. Please try again,” typically caused by the login URL not matching the WHMCS System URL setting, often after adding SSL or moving the installation, and the fix: align the URL with the System URL setting in General Settings.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/login-redirect-loops/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/login-redirect-loops/Covers login redirect loops and Invalid csrf protection token errors caused by PHP session problems, with diagnostics via System Health and the test_sessions.php file, plus fixes: correct the session tmp path’s permissions/space, or disable Session IP Check or use database session storage.https://docs.whmcs.com/9-1/system/php/login-session-length/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/php/login-session-length/Explains that the session.gc_maxlifetime PHP setting (default 1440 seconds) controls login timeout, how to increase it via php.ini or a custom php.ini file in the WHMCS directory, and how conflicting session.save_path values from other PHP scripts on the same account can shorten it unexpectedly.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-licensing/no-connection-errors/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-licensing/no-connection-errors/Covers the No Connection admin login error caused by cURL or DNS problems, with steps to test connectivity via login.php?conntest=1 against a.licensing.whmcs.com, verify DNS for whmcs.com, and a PHP 7 workaround for restrictive shared or reseller hosting.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/oops-access-denied-errors/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/oops-access-denied-errors/Covers the “Oops! Access Denied - Forbidden” error, caused by missing administrator role permissions, a missing account owner password blocking Login as Owner, or restricted WHMCS Cloud features, and fixes: assign permissions in Administrator Roles or reset the owner’s password via email, SQL, or manual reset.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/oops-too-many-requests-errors/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/oops-too-many-requests-errors/Covers the Client Area error “Oops! You have sent too many requests,” triggered by 10 failed login attempts within 10 minutes, and gives the fix: verify login credentials and retry after the temporary block clears, checking the Activity Log for the source IP.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/php-session-storage-errors/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/php-session-storage-errors/Covers the login-blocking error “PHP session storage is not writeable,” caused by mismatched session.save_path values across PHP configuration files or a non-writable storage location, and the fix: align session.save_path across configs and grant write permissions to the storage location.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/remember-me-session-ended/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/remember-me-session-ended/Diagnoses an ended admin Remember Me session by cause: 30-day expiry, exceeding the 5-device Remember Me cap, logout or signing in without Remember Me, a password change, an IP address or browser change, an admin being disabled, or an encryption hash rotation, with steps to check the Activity Log and Admin Log for unrecognized sessions.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/sessions-are-not-removed/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/sessions-are-not-removed/Attributes persistent sessions to non-standard PHP session.gc_probability and session.gc_divisor values, often 0, which disable garbage collection, and directs self-hosted users to restore the defaults or WHMCS Cloud users to contact Technical Support.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/sso-active-session-errors/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/sso-active-session-errors/Covers the OAuth authorization request denied due to unexpected active login session for Closed User ID error, and lists steps to terminate the session in the Admin Log, change the client Profile Status to Active or Inactive, and retry with a new token.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/sso-closed-user-errors/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/sso-closed-user-errors/Covers the Single Sign-On authentication denied for Closed User ID error, caused by attempting single sign-on for a client whose account status is Closed, and gives the fix of updating the client’s Profile Status field to Active or Inactive and saving the change.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/sso-configuration-errors/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/sso-configuration-errors/Covers the Single Sign-On authentication denied per configuration for User ID error, caused by the client disabling single sign-on in their Client Area security settings, and gives the fix of the client re-enabling single sign-on under Account > Security Settings and saving the change.https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/sso-token-errors/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/troubleshooting/troubleshoot-authentication/sso-token-errors/Covers the Unable to authenticate with Single Sign-On token for User ID error, lists checks for CreateSsoToken API success, OAuth token validity, token expiry, user ID, and client status, and gives the fix of generating and redirecting with a new single-use token.https://docs.whmcs.com/9-1/system/authentication/authentication-tutorials/enable-2fa-globally/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/authentication/authentication-tutorials/enable-2fa-globally/Lists the steps to activate a 2FA service at Configuration > System Settings > Two Factor Authentication, including the Enable for use by Clients and Enable for use by Administrative Users checkboxes and saving the configuration.https://docs.whmcs.com/9-1/system/authentication/authentication-tutorials/enable-2fa-for-admins/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/authentication/authentication-tutorials/enable-2fa-for-admins/Provides the six-step process for an admin to enable Time-Based Token 2FA from My Account, including scanning the QR code, entering the authenticator app code, and recording the backup code.https://docs.whmcs.com/9-1/system/authentication/authentication-tutorials/enable-2fa-for-clients/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/authentication/authentication-tutorials/enable-2fa-for-clients/Walks through enabling Time-Based Token 2FA from Security Settings in the Client Area, including scanning the QR code and recording the backup code, and notes that admins can disable but not enable 2FA for users at Clients > Manage Users.https://docs.whmcs.com/9-1/system/authentication/authentication-tutorials/log-in-without-a-backup-code/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/authentication/authentication-tutorials/log-in-without-a-backup-code/Gives the SQL command to clear the authmodule and authdata fields in the tbladmins database table for a self-hosted installation, letting a locked-out admin log in without 2FA and reconfigure it on a new device.https://docs.whmcs.com/9-1/system/authentication/authentication-tutorials/log-in-without-a-token/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/authentication/authentication-tutorials/log-in-without-a-token/Explains the 16-character backup code format, then gives separate step-by-step logins using the Login using Backup Code link for the Admin Area and Client Area, plus how an admin disables 2FA afterward via My Account.https://docs.whmcs.com/9-1/system/authentication/authentication-tutorials/require-2fa/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/authentication/authentication-tutorials/require-2fa/Details the Global Two-Factor Authentication Settings checkboxes at Configuration > System Settings > Two Factor Authentication that force users and admins to set up 2FA on their next login.https://docs.whmcs.com/9-1/system/authentication/authentication-tutorials/sign-in-using-facebook/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/authentication/authentication-tutorials/sign-in-using-facebook/Steps through creating a Facebook developer app, requesting public_profile permission, retrieving the App ID and Secret, and entering those credentials under Configuration > System Settings > Sign-In Integrations to activate Facebook login.https://docs.whmcs.com/9-1/system/authentication/authentication-tutorials/sign-in-using-google/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/authentication/authentication-tutorials/sign-in-using-google/Steps through creating a Google Developer Project, configuring the OAuth consent screen and authorized domains, generating the Client ID and Client Secret, and entering those credentials under Configuration > System Settings > Sign-In Integrations to activate Google login.https://docs.whmcs.com/9-1/system/authentication/authentication-tutorials/sign-in-using-twitter/Mon, 01 Jan 0001 00:00:00 +0000https://docs.whmcs.com/9-1/system/authentication/authentication-tutorials/sign-in-using-twitter/Covers creating a Twitter developer app, saving the API key and secret, configuring OAuth 2.0 callback URLs, and entering the ConsumerKey and ConsumerSecret under Configuration > System Settings > Sign-In Integrations to activate Twitter login.