A remote access key (also called an access hash) is a security credential that allows external systems to communicate with your cPanel/WHM server. You can use this key for automated account creation scripts, billing software integration, and DNS or configuration cluster setups. However, this feature has been deprecated since cPanel version 64, and you should now use API tokens instead for better security and functionality.
Important Deprecation Notice
The Remote Access Key feature is no longer recommended for use. Starting with cPanel & WHM version 64, this authentication method has been deprecated in favor of the more secure API token system.
Here's what you need to know:
- The Manage API Tokens interface (WHM >> Home >> Development >> Manage API Tokens) is the recommended replacement
- Remote Access Key interface only appears if you enable the "Allow deprecated WHM accesshash authentication" setting in Tweak Settings
- You can convert existing access hashes to API tokens using the /usr/local/cpanel/scripts/convert_accesshash_to_token script
- OBHost recommends migrating to API tokens for improved security
What Can You Use Remote Access Keys For?
While deprecated, remote access keys historically served several purposes:
- Automated account creation: Scripts that create hosting accounts without manual intervention
- External billing software: Integration with billing platforms to manage customer accounts
- DNS clusters: Allowing multiple servers to synchronize DNS records
- Configuration clusters: Enabling servers to share configuration settings
How to Generate a New Access Key
If you still need to generate an access key (only available when deprecated authentication is enabled), follow these steps:
- Click the "Generate New Key" button in the Remote Access Key interface
- Copy the newly generated access key
- Paste the key into the appropriate configuration file on the remote server that needs to communicate with your web server
- Save the configuration and test the connection
You can view your current access hash from the command line by checking the /root/.accesshash file on your server.
Understanding Access Key Signatures
The access key signature displays the first 32 characters of your remote access key, separated by colons. This shortened format helps you quickly verify that you're using the correct access key in interfaces that don't display the full key for security reasons.
Migrating to API Tokens
API tokens offer several advantages over legacy access keys:
- Better security: Tokens can be scoped to specific permissions
- Easier management: Create, revoke, and monitor tokens individually
- Improved tracking: See when and how each token is used
- Modern standard: API tokens align with current security best practices
To migrate from access hashes to API tokens, run the conversion script or manually create new tokens through the Manage API Tokens interface in WHM.
Frequently Asked Questions
Why was the remote access key deprecated?
Remote access keys were deprecated because API tokens provide more granular security controls, better audit trails, and easier management. API tokens can be limited to specific permissions and revoked individually without affecting other integrations.
Can I still use my existing access hash?
Yes, if you enable the "Allow deprecated WHM accesshash authentication" setting in Tweak Settings. However, this is not recommended for security reasons. You should convert your access hash to an API token as soon as possible.
Where is the access key stored on my server?
The access hash is stored in the /root/.accesshash file on your server. This file contains the full authentication key used for remote server communications.
What happens if I generate a new access key?
Generating a new access key immediately invalidates the old one. Any external systems or scripts using the previous key will stop working until you update them with the new key. Make sure to update all remote servers and applications before generating a new key.
If you need help migrating from access keys to API tokens or have questions about server authentication, the OBHost support team is available 24/7. Visit our contact page or email support@obhost.org for assistance.
