Sensitive API permissions and the spending limit: paying, buying, reinstalling, cPanel access

The short answer: anything that can cost money, delete data or give full access to the account has its own permissions, kept apart from the others and off by default. On top of that, every key has a spending limit per 30 days: with the limit at 0, the key spends nothing. Turn these permissions on only in the key that really needs them.

The sensitive permissions

Permission	What for	Status
domains:transfer_code	Request a domain's transfer code	Available
domains:owner_change	Change a domain's holder	Coming soon
vps:reinstall	Reinstall a server (wipes everything)	Available
vps:restore	Restore a server from a backup	Available
vps:password	Change the root password and receive it in the answer	Available
billing:pay	Pay invoices from your credit	Available
billing:purchase	Buy domains and extras with your credit	Available
services:cancel	Request the cancellation of a service	Available
hosting:login	Create a cPanel login link, with full access to the hosting	Available
hosting:code	Create FTP accounts and cron jobs, which can run code in the account	Available

hosting:login and hosting:code give access to the cPanel account. That is why they lack the protection the API gives to the domain of the account e-mail (the mailbox that receives password resets). A key with them can, in practice, reach everything in the hosting. Give them only to keys that truly need them.

The spending limit

Every key has a maximum it may spend in 30 days, in your account currency (for example, USD). You set it when you create the key. With the limit at 0, the key cannot spend.

Today the API only charges your account credit, and only in these cases: domain purchases (registration, renewal, transfer), extras purchases and invoices paid with credit. It never charges any other way.

If...	The API answers	Charged?
The operation goes over the key's spending limit	403 spending_limit_exceeded	No
The account credit is not enough	402 insufficient_credit	No
The key is Sandbox, or the API is in preparation	A simulated answer	No

Checking what has been spent

GET /v1/limits returns the key's spending limit, what has been spent and the 30-day window, plus the requests left this minute. Any valid key can call it.

curl https://api.mozout.com/v1/limits -H "Authorization: Bearer $RLX_API_KEY"

Setting up keys sensibly

1	A read-only key (reports, dashboards, alerts): no sensitive permissions, spending limit at 0.

2	A key that renews domains: domains:write and billing:purchase, with a spending limit sized to the renewals you expect.

3	A VPS admin key: vps:write to start and restart; vps:reinstall or vps:password only if the program really needs them, ideally in a separate key with an IP list.

4	A key that pays invoices: billing:pay, with an IP list and a short validity.

Need a higher limit? The API's advice for spending_limit_exceeded is to create a key with a higher limit. Do it on the API page and revoke the old one. To top up your credit, use the usual payment methods.

About to let a key pay, buy or reinstall? Create it separately, with an IP list and a low spending limit.

Create a key

Categories

Categories