The Xtream AI Panel WHMCS Module is the officially supported way to connect a WHMCS installation to an Xtream AI Panel. It ships as one WHMCS addon plus one server module, both released as open source under the MIT license. The full source and the release tarballs live at github.com/Xtream-AI/whmcs-xtreamai. The current release is v1.14.0.

The module is standalone. It carries its own HTTP client, its own storage, its own escaping and its own credential generators. Installing it does not require Composer, does not require a background worker, and does not need any third party service beyond your Xtream AI Panel itself. The wire format it speaks against the panel is the same JSON contract as the official PHP and Python SDKs, so if you later want to script the panel from your own PHP code the two can coexist happily side by side.

If WHMCS is where your billing lives, this module closes the loop between "the customer paid the invoice" and "the line is live on the panel". That is the loop most integrators wire up first, and it is the loop this module was written to make routine.

What the module does end to end

The module maps every lifecycle event WHMCS emits for a service onto the matching panel call. Nothing you configure has to be re-configured in the panel by hand, and nothing the panel decides has to be re-read on your side by cron. The complete list, in the order a customer's life on your system flows:

  • The order is provisioned. At the moment you tell WHMCS to run the module's setup for that product — as soon as an order is placed, as soon as the first payment is received, when you accept the order manually, or never — the module generates a username and a password (both configurable in General Settings), creates the line on the panel with the bouquets and package you picked in the product, saves the credentials on the WHMCS service, and writes the panel's expiry into the service's next due date so the two systems agree from day one.
  • The customer can bring the credentials. With the Customer username and Customer password options on a Line or Sub-Reseller product, the username and the password come from WHMCS custom fields the customer fills in at checkout; the module validates them, checks the panel where that is needed, and still never adopts an existing line from a customer order (password option: module 1.10.0 and later). See Configure.
  • Invoice goes unpaid, WHMCS suspends. The module posts POST /lines/{id}/disable. The line stops working the moment the panel receives the call. No credits are charged.
  • Invoice paid, WHMCS unsuspends. The module posts POST /lines/{id}/enable. The line resumes without going through provisioning again.
  • Renewal invoice paid, WHMCS renews. The module posts POST /lines/{id}/renew with the current package id. The panel bumps exp_date by the package cycle and returns the new expiry, which the module writes back to nextduedate.
  • Customer clicks "Change Password" in their client area. The module honors the password the customer typed if it passes a light validation (alphanumeric, 8 to 32 characters); otherwise the module regenerates one. Either way it posts POST /lines/{id}/reset-password on the panel and updates the WHMCS record.
  • Customer upgrades or downgrades to another product. With an admin key the module posts POST /lines/{id}/update with the new package and the new product's bouquets. The panel applies the new package to the same line, so the customer keeps their username, password and expiry and the switch is invisible in their app. Nothing is charged on the panel; WHMCS bills the difference. With a reseller key the panel does not allow a free package change, and the module says so instead of half-applying it.
  • Customer or operator cancels. The module posts POST /lines/{id}/delete and unlinks the service. The line is gone from the panel; the WHMCS record stays for accounting.

The same lifecycle applies to Sub-Reseller products with two differences. First, the panel object created is a reseller account, not a line, so credits stand in for the package. Second, the panel API does not currently expose a reseller status field, so Suspend, Unsuspend and Terminate cannot toggle the account by API. When those actions fire on a Sub-Reseller product the module surfaces a clear error and preserves the WHMCS to panel link so you can complete the action manually from your panel and retry. See Provisioning Modes for the full mapping.

A third mode, Credit top-up, was added in the 1.8 line: the product adds credits to an existing Sub-Reseller account on that panel, so an order tops up an existing account instead of creating a new one. The customer can also type the panel account in a Reseller username custom field, and the module credits the username it finds on the panel even when WHMCS never created that account.

Who the module is for

The module has two audiences, and each one reaches a different subset of features depending on the API key type you paste into the addon.

Resellers on any Xtream AI Panel. This is by far the most common case. You have a reseller account with your Xtream AI provider, you sell IPTV lines to end users through WHMCS, and the provider's admin never sees your customers directly. A reseller key gives you the full Line lifecycle out of the box, including create, suspend, unsuspend, renew, reset password and terminate, plus the read-only Catalog view. Sub-Reseller and Credit top-up products require an admin key and are therefore off the table for a pure reseller deployment.

Panel administrators. Less common. You run your own Xtream AI Panel and sell directly. An admin key unlocks every feature, including Sub-Reseller products, per-line max_connections, product upgrades and downgrades that swap the panel package on a live line, the Sub-Resellers view in the addon, credit adjustments and the extra Line update fields (exp_date, is_restreamer, allowed_ips, allowed_ua, is_isplock). The complete admin versus reseller matrix is on the Reseller vs Admin Keys page.

Both audiences use the same code path. There is no separate build. The addon reads the key type from the panel entry you saved and unlocks or greys out UI elements accordingly.

What the addon UI exposes

The WHMCS addon (accessed at Addons → Xtream AI Panel in the WHMCS admin) is where the module is operated day to day. Seven tabs cover the whole surface.

Dashboard. A summary of everything the module knows about. Cards for credits, panels (total and healthy), sub-resellers and lines. The status list underneath surfaces per-panel health so a broken key or an unreachable panel is visible before a customer notices.

Panels. The list of panel connections you have added, with per-row Test, Edit, Activate/Deactivate and Delete actions. The Add Panel and Edit Panel form live in the same tab, and the same Test button that lives in the list works against unsaved credentials so you can verify a token before you save it.

Sub-Resellers. Admin-key-only. Lists sub-resellers created through the module with their username, email, status, member group and credits balance. Includes a small credit adjustment form (positive or negative delta with an optional reason) that maps directly onto POST /resellers/{id}/billing/adjust.

Lines. A searchable list of lines the module has created on the selected panel, with filters by username and enabled/disabled status. This view calls GET /lines under the hood, so the ownership rules of the API apply: reseller keys see only their own lines, admin keys see everything.

Catalog. Read-only browser for live streams and VOD entries on the selected panel. Optional scopes streams:read and vods:read on the key. Handy for verifying that a package's bouquets carry what you expect before you tie a WHMCS product to it.

Bulk tools. Three batched operations for many services at once: index the panel's lines, link existing WHMCS services to them (by the WHMCS:<service id> tag in the line notes, then by username) and re-run Sync on every linked service. This is the migration path from another WHMCS module and the way to push a changed connection count to every line. See Bulk Tools.

Module Logs. A view over WHMCS's native tblmodulelog filtered to this module. Every panel call is recorded with a date, an action name and a short summary. API tokens never appear here, even when a request fails.

General Settings. The credential generators (username, password, prefix, length, character class, live preview) and the line notes template with its tag list ({service_id}, {client_id}, {client_name}, {client_email}, {client_phonenumber}, {product_name}) and a live example. The template card also carries the Write notes switch, on by default: turn it off and the module writes no notes when an account is created, synced or moved to another package, and the notes already on the panel are left as they are.

What the customer sees

In the WHMCS client area, opening an active service renders the module's client template. The customer sees a card titled "IPTV Line Details" with:

  • The username, with a one-click Copy button that puts the value on the clipboard.
  • The password, hidden by default behind a Show toggle, with a Copy button of its own.
  • The line status as reported by the panel (Active, Suspended and so on).
  • The expiry date for Line products, or the credits balance for Sub-Reseller products.
  • The M3U URL the customer plugs into their IPTV app, if you filled the optional M3U URL on the panel entry. Placeholders {username} and {password} are replaced with the line credentials.
  • The EPG URL the customer loads for the TV guide, if you filled the optional EPG URL on the panel entry. Same placeholders, same replacement.
  • A live Active Connections table with the current stream, IP, country and elapsed time on every session. The counter next to the title shows the connections in use and, from module 1.14.0, the maximum the line allows, for example 1 / 2. Until the module has read that maximum from the panel, the counter shows only the connections in use.

If the line has not been provisioned yet (for example, the first invoice was just paid and the module has not finished creating the line), the card shows a short "Your IPTV line is not ready yet" notice instead of blank fields. The active-connections view queries the panel on demand from the browser, so a customer with heavy zapping habits sees an accurate list without you polling anything.

Where the module speaks HTTPS to the panel

Everything the module does goes through the Public API of your Xtream AI Panel, over HTTPS, with your token in the Authorization: Bearer header. The panel must run 2.1.2 or newer with PANEL_API_ENABLED=true set in its configuration. One feature asks for more than that floor: product upgrades and downgrades that swap the panel package need a panel updated on or after 2026-09-14, since that is when the Public API started accepting a package change on a live line. Everything else works on any 2.1.2 panel. The token itself is stored on the WHMCS side encrypted with WHMCS's own encrypt() helper. It is never written to logs and never included in an error message that a customer or a lower-privileged admin could see.

The single wire format means the module is not tied to a private protocol. If tomorrow you want to run a nightly reconciliation script from a totally different machine, you can point the official PHP SDK at the same panel with the same token and it will see the same lines the module created. The two can be used together, or you can ignore both in favor of raw curl if that is what suits your build.

Where to go next

The docs are organized to walk you from a fresh WHMCS in a straight line to a product that provisions and renews on its own:

  • Quickstart. The short path, from an empty WHMCS to a provisioned test order.
  • Install. Download, verify, drop the two folders in place, activate the addon.
  • Configure. Obtain your API key, add your panel to the addon, and wire up your first product.
  • Reseller vs Admin Keys. The complete capability matrix, so you pick the right key type before you paste it.
  • Provisioning Modes. Line, Sub-Reseller and Credit top-up: what each mode creates on the panel and which lifecycle actions map to which panel calls.
  • Troubleshooting. The most common failures and how to fix them.