API tokens

API tokens

You create API tokens on the API Tokens page in the panel (https://panel.cloudweb.sk/api-tokens). The full token is shown exactly once, right after creation – reopening the page never shows it again, so save it somewhere you control.

Scopes

When creating a token you pick one or more of these scopes:

• hostings:read – view hostings
• domains:read – view domains
• invoices:read – view invoices
• dns:read – view DNS records
• dns:write – create and update DNS records
• dns:delete – delete DNS records
• dns:acme – only add/remove the _acme-challenge TXT record (DNS-01 certificate issuance)

dns:write does not include dns:acme and vice versa – they're deliberately separate, narrow permissions. A token meant to run on a third-party server (e.g. to issue certificates) should therefore only be given dns:acme, so a leak of it can't let an attacker rewrite regular A/MX records.

A token can also be restricted to specific domains from the ones you manage DNS for – the restriction applies to both the REST DNS management and the ACME endpoint. For an overview of the record types you can manage this way, see DNS records: what they are and how they work.

Expiry and limits

At creation you choose an expiry in days (1 to 365), or leave the token without one. You can have at most 10 tokens per account at once – reaching the limit means deleting one first. Each individual token is rate-limited to 60 requests per minute.

In-panel setup guide

The API Tokens page includes a usage guide right inside the panel – the API base URL, the Authorization header format, and the list of available endpoints for your chosen scopes. This guide is part of the logged-in panel; it is not reachable without logging in.

DNS-01 challenge for wildcard certificates

If you need to issue a wildcard certificate (*.example.sk) outside of Cloudweb – for example via Traefik, lego, acme.sh or certbot – a wildcard can only be validated via the DNS-01 challenge, i.e. by writing an _acme-challenge TXT record. Two public endpoints exist for exactly that:

• POST https://cloudweb.sk/api/v1/acme/present
• POST https://cloudweb.sk/api/v1/acme/cleanup

Authentication is either an Authorization: Bearer <token> header or HTTP Basic, where the password is the token (the username is ignored) – useful for tools that only support Basic auth. The dns:acme scope is required. The contract matches lego's httpreq provider and acme.sh's dns_acmeproxy provider, so no special plugin is needed – just point the endpoint and set the token as the username/password.