API Token Authentication

PanelConfig API authentication is based on bearer tokens. A token is generated in PCAdmin, shown once, hashed with SHA-256, and stored in the api_tokens table. Incoming API requests send the plain token in the Authorization header. The API hashes the supplied token and looks up an active, non-expired token attached to an active user.

Authentication Flow

sequenceDiagram
    participant Client
    participant API
    participant Auth
    participant Database
    Client->>API: GET /api/v1/me.php with Bearer token
    API->>Auth: Extract token from Authorization header
    Auth->>Database: Look up SHA-256 token hash
    Database-->>Auth: Active token and active user
    Auth->>Database: Update token last_used_at
    Auth->>Database: Insert api_requests row when table exists
    Auth-->>API: User context
    API-->>Client: JSON response

Example

curl -s https://panel.example.com/api/v1/me.php \
  -H "Authorization: Bearer pc_YOUR_TOKEN" \
  -H "Accept: application/json"

Expected Success

{
  "success": true,
  "message": "API profile loaded.",
  "data": {
    "user": {
      "id": 1,
      "name": "Operator",
      "email": "operator@example.com",
      "role": "admin"
    }
  },
  "timestamp": "2026-06-19T00:00:00+00:00"
}

Common Failures

• Missing header: the API returns 401 with Missing API bearer token.
• Unknown, expired, revoked, or inactive-user token: the API returns 401 with Invalid or expired API token.
• Role-blocked endpoint: the API returns 403 with Admin API access is required.

Security Notes

• The plain token is shown once; copy it into a secret manager immediately.
• Do not paste tokens into support tickets, Git repositories, browser-visible JavaScript, or public CI logs.
• Create separate tokens for monitoring, billing, deployment, and security review.