{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-rest-api/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Authentication","description":"Developer documentation for the WHMCS API — the","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"authentication","__idx":0},"children":["Authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["WHMCS API may use different authentication methods for different areas of the API."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"store-and-cart-operations","__idx":1},"children":["Store and Cart Operations"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For store and cart operations, use an X-Api-State header if a cart is associated with a logged-in user."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["X-Api-State represents a state of the cart."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Each response will return a new value."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Each request must include the latest X-Api-State header."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For example, a request with the X-Api-State header:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"curl -X GET --location \"https://example.com/api/v2/cart/TLlowSWlQjGkGrC1/totals\"\n  -H \"X-Api-State: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczpcL1wvd2htY3MtZGV2LnRlc3RcLyIsImF1ZCI6Imh0dHBzOlwvXC93aG1jcy1kZXYudGVzdFwvIiwiZXhwIjoxNjQ3NTYzMzI3LCJzdWIiOltdLCJ3aG1jc191c2VyIjoiMzlhNDA0NTFlOGE4NjhhZWI4NjExYzEwNGE5OTYwMzk2NmM2MmIyMzg0YWYyYjc4OWJhOGU2YmYxYWVhYjMzYSJ9.B4-Ug6AcVCI52woiW9dF_ylYZXf57e32RSk_7S78Z9M\"\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["With payload:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"curl -X POST --location \"https://example.com/api/v2/cart/6isLR0SAB0TbCiws/promotion\"\n  -H \"Content-Type: application/json\"\n  -H \"X-Api-State: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczpcL1wvd2htY3MtZGV2LnRlc3RcLyIsImF1ZCI6Imh0dHBzOlwvXC93aG1jcy1kZXYudGVzdFwvIiwiZXhwIjoxNjQ3MzkyODM1LCJzdWIiOltdLCJ3aG1jc191c2VyIjoiMzlhNDA0NTFlOGE4NjhhZWI4NjExYzEwNGE5OTYwMzk2NmM2MmIyMzg0YWYyYjc4OWJhOGU2YmYxYWVhYjMzYSJ9.LfYOrxW5OOtdcfyDOuIa6B0dTytYROMrccqpywxvAB8\"\n  -d \"{\\\"code\\\":\\\"CARTAPI\\\"}\"\n"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"logging-in","__idx":2},"children":["Logging In"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To log in, you must include the user's email address and password."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For example:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"curl -X POST --location \"https://example.com/whmcs/api/v2/user/session\"\n  -H \"Content-Type: application/json\"\n  -d \"{\\\"email\\\":\\\"test@test.com\\\",\\\"password\\\":\\\"pwd123456\\\"}\"\n"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"logging-in-with-two-factor-authentication","__idx":3},"children":["Logging In with Two-Factor Authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the user has enabled Two-Factor Authentication, send an additional request to verify the Two-Factor Authentication token before authenticating the user."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For example:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"curl -X POST --location \"https://example.com/whmcs/api/v2/user/session/verify\"\n  -H \"Content-Type: application/json\"\n  -H \"X-Api-State: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczpcL1wvd2htY3MtZGV2LnRlc3RcLyIsImF1ZCI6Imh0dHBzOlwvXC93aG1jcy1kZXYudGVzdFwvIiwiZXhwIjoxNjQ3NDQwMzc5LCJzdWIiOiI1MzJlZmM4ZmI5NzA2NDQ4ZDZkMDMwMTc1ZmFlY2U3N2QxN2E5OGRjN2FkNTZlZWZhZmZjYTRmNzY2ZDJiZjE4In0.Igj9Kby5FR5m4w03x92NwuKviCLRQBQUaLbaXTqQ9kc\"\n  -d \"{\\\"fields\\\":{\\\"key\\\":\\\"417339\\\"}}\"\n"},"children":[]}]},"headings":[{"value":"Authentication","id":"authentication","depth":1},{"value":"Store and Cart Operations","id":"store-and-cart-operations","depth":2},{"value":"Logging In","id":"logging-in","depth":2},{"value":"Logging In with Two-Factor Authentication","id":"logging-in-with-two-factor-authentication","depth":2}],"frontmatter":{"title":"Authentication","seo":{"title":"Authentication"}},"lastModified":"2026-08-03T20:15:25.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/rest-api/authentication","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}