Generate and save an Enhance API key

Generate this token in Enhance when you want to use ApiMachine website bulk tools. Ordinary cPFence protection does not require it.

Create the token

1. Sign in to your Enhance control panel.
2. Open Settings → Access tokens → Create Token.
3. Choose Super admin and create the token. Keep it private.

Restrict the token by IP (optional)

To accept the token only from your server, turn on IP restricted. Then add each of these addresses to Allowed IPs and select Add after each one:

Address	What to enter
The server itself	127.0.0.1/32
Main control panel server’s public IPv4	Its IPv4 address with /32, for example 203.0.113.10/32
Main control panel server’s public IPv6	Its IPv6 address with /128, for example 2001:db8::1/128. Skip this if the server has no IPv6.

Allowed IPs with 127.0.0.1/32 highlighted. The server's public IPv4 and IPv6 addresses are blurred. Select the image to enlarge it; use your browser's Back command to return.

Include 127.0.0.1/32 even though it is not a public address. cPFence sends its requests to your panel’s own address from the main control panel server, so Enhance can see them as coming from the server itself (127.0.0.1) or from its public address, depending on how that address resolves on the server. If the key does not validate while IP restricted is on, check these entries first.

Save it in cPFence

1. On the main control panel server’s WebUI, open Tools & Utilities → ApiMachine Bulk Tools → API key.
2. Select Set a new key if a key is already saved, then enter the token privately.
3. Select Save new API key, then check the validation result before running a bulk action.

Paste the token privately and save it. The screenshot leaves the key field empty; it does not show a submitted or validated token. Select the image to enlarge it; use your browser's Back command to return.

CLI alternative, from root on the main control panel server:

cpfence --set-enhance-api-key

Enter the key at the private prompt. cPFence validates it and stores the encrypted value locally. Keep the server’s configuration and your original token private.

Optional for protection

The token is required for ApiMachine, so you can skip this setup if you do not use those tools. A token problem does not require reinstalling cPFence.

Next, follow website selection and bulk-action steps. If validation fails, check the token role, IP restriction, Enhance API access, and cPFence license before contacting support.