The Xtream AI Panel WHMCS Module is the officially supported way to hook a WHMCS installation into an Xtream AI Panel. It ships as one WHMCS addon plus one server module, both released as open source under the MIT license. The full source and the release tarballs live at github.com/Xtream-AI/whmcs-xtreamai. The current release is v1.0.0.

The module is standalone. It carries its own HTTP client, its own storage, its own escaping and its own credential generators. Installing it does not require Composer, does not require a background worker, and does not need any third party service beyond your Xtream AI Panel itself. The wire format it speaks against the panel is the same JSON contract as the official PHP and Python SDKs, so if you later want to script the panel from your own PHP code the two can coexist happily side by side.

If WHMCS is where your billing lives, this module closes the loop between "the customer paid the invoice" and "the line is live on the panel". That is the loop most integrators wire up first, and it is the loop this module was written to make routine.

What the module does end to end

The module maps every lifecycle event WHMCS emits for a service onto the matching panel call. Nothing you configure has to be re-configured in the panel by hand, and nothing the panel decides has to be re-read on your side by cron. The complete list, in the order a customer's life on your system flows:

  • Order accepted, first invoice paid. WHMCS calls CreateAccount on the module. The module generates a username and a password (both configurable in General Settings), creates the line on the panel with the bouquets and package you picked in the product, saves the credentials on the WHMCS service, and pushes the panel's expiry back into tblhosting.nextduedate so the two systems agree from day one.
  • Invoice goes unpaid, WHMCS suspends. The module posts POST /lines/{id}/disable. The line stops working the moment the panel receives the call. No credits are charged.
  • Invoice paid, WHMCS unsuspends. The module posts POST /lines/{id}/enable. The line resumes without going through provisioning again.
  • Renewal invoice paid, WHMCS renews. The module posts POST /lines/{id}/renew with the current package id. The panel bumps exp_date by the package cycle and returns the new expiry, which the module writes back to nextduedate.
  • Customer clicks "Change Password" in their client area. The module honors the password the customer typed if it passes a light validation (alphanumeric, 8 to 32 characters); otherwise the module regenerates one. Either way it posts POST /lines/{id}/reset-password on the panel and updates the WHMCS record.
  • Customer or operator cancels. The module posts POST /lines/{id}/delete and unlinks the service. The line is gone from the panel; the WHMCS record stays for accounting.

The same lifecycle applies to Sub-Reseller products with two differences. First, the panel object created is a reseller account, not a line, so credits stand in for the package. Second, the panel API does not currently expose a reseller status field, so Suspend, Unsuspend and Terminate cannot toggle the account by API. When those actions fire on a Sub-Reseller product the module surfaces a clear error and preserves the WHMCS to panel link so you can complete the action manually from your panel and retry. See Provisioning Modes for the full mapping.

Who the module is for

The module has two audiences, and each one reaches a different subset of features depending on the API key type you paste into the addon.

Resellers on any Xtream AI Panel. This is by far the most common case. You have a reseller account with your Xtream AI provider, you sell IPTV lines to end users through WHMCS, and the provider's admin never sees your customers directly. A reseller key gives you the full Line lifecycle out of the box, including create, suspend, unsuspend, renew, reset password and terminate, plus the read-only Catalog view. Sub-Reseller products require an admin key and are therefore off the table for a pure reseller deployment.

Panel administrators. Less common. You run your own Xtream AI Panel and sell directly. An admin key unlocks every feature, including Sub-Reseller products, per-line max_connections, the Sub-Resellers view in the addon, credit adjustments and the extra Line update fields (exp_date, is_restreamer, allowed_ips, allowed_ua, is_isplock). The complete admin versus reseller matrix is on the Reseller vs Admin Keys page.

Both audiences use the same code path. There is no separate build. The addon reads the key type from the panel entry you saved and unlocks or greys out UI elements accordingly.

What the addon UI exposes

The WHMCS addon (accessed at Addons → Xtream AI Panel in the WHMCS admin) is where the module is operated day to day. Six tabs cover the whole surface.

Dashboard. A summary of everything the module knows about. Cards for credits, panels (total and healthy), sub-resellers and lines. The status list underneath surfaces per-panel health so a broken key or an unreachable panel is visible before a customer notices.

Panels. The list of panel connections you have added, with per-row Test, Edit, Activate/Deactivate and Delete actions. The Add Panel and Edit Panel form live in the same tab, and the same Test button that lives in the list works against unsaved credentials so you can verify a token before you save it.

Sub-Resellers. Admin-key-only. Lists sub-resellers created through the module with their username, email, status, member group and credits balance. Includes a small credit adjustment form (positive or negative delta with an optional reason) that maps directly onto POST /resellers/{id}/billing/adjust.

Lines. A searchable list of lines the module has created on the selected panel, with filters by username and enabled/disabled status. This view calls GET /lines under the hood, so the ownership rules of the API apply: reseller keys see only their own lines, admin keys see everything.

Catalog. Read-only browser for live streams and VOD entries on the selected panel. Optional scopes streams:read and vods:read on the key. Handy for verifying that a package's bouquets carry what you expect before you tie a WHMCS product to it.

Module Logs. A view over WHMCS's native tblmodulelog filtered to this module. Every panel call is recorded with a date, an action name and a short summary. API tokens never appear here, even when a request fails.

General Settings. The credential generators (username, password, prefix, length, character class, live preview) and the line notes template with its tag list ({service_id}, {client_id}, {client_name}, {client_email}, {client_phonenumber}, {product_name}) and a live example.

What the customer sees

In the WHMCS client area, opening an active service renders the module's client template. The customer sees a card titled "IPTV Line Details" with:

  • The username, with a one-click Copy button that puts the value on the clipboard.
  • The password, hidden by default behind a Show toggle, with a Copy button of its own.
  • The line status as reported by the panel (Active, Suspended and so on).
  • The expiry date for Line products, or the credits balance for Sub-Reseller products.
  • The M3U URL the customer plugs into their IPTV app, if you filled the optional M3U URL on the panel entry.
  • A live Active Connections table with the current stream, IP, country and elapsed time on every session.

If the line has not been provisioned yet (for example, the first invoice was just paid and the CreateAccount hook has not run to completion), the card shows a short "Your IPTV line is not ready yet" notice instead of blank fields. The active-connections view queries the panel on demand from the browser, so a customer with heavy zapping habits sees an accurate list without you polling anything.

Where the module speaks HTTPS to the panel

Everything the module does goes through the Public API of your Xtream AI Panel, over HTTPS, with your token in the Authorization: Bearer header. The panel must run 2.1.2 or newer with PANEL_API_ENABLED=true set in its configuration. The token itself is stored on the WHMCS side encrypted with WHMCS's own encrypt() helper. It is never written to logs and never included in an error message that a customer or a lower-privileged admin could see.

The single wire format means the module is not tied to a private protocol. If tomorrow you want to run a nightly reconciliation script from a totally different machine, you can point the official PHP SDK at the same panel with the same token and it will see the same lines the module created. The module and the SDK can be used together, replaced by each other, or ignored in favor of raw curl if that is what suits your build.

Where to go next

The docs are organized to walk you from a fresh WHMCS in a straight line to a product that provisions and renews on its own:

  • Install. Download, verify, drop the two folders in place, activate the addon.
  • Configure. Obtain your API key, add your panel to the addon, and wire up your first product.
  • Reseller vs Admin Keys. The complete capability matrix, so you pick the right key type before you paste it.
  • Provisioning Modes. Line versus Sub-Reseller: what each mode creates on the panel and which lifecycle actions map to which panel calls.
  • Troubleshooting. The most common failures and how to fix them.