We log search terms to improve our documentation. For more information, read our Privacy Policy.
  1. cPanel & WHM Documentation
  2. cPanel
  3. Meridian
  4. Security
  5. Managing SSH Keys and API Tokens
cpanelui meridian security ssh apitoken

Managing SSH Keys and API Tokens

Last modified: 2026 July 24

Overview

Manage SSH keys and API tokens from the Advanced tab of the Meridian Security hub to give tools and scripts secure, developer-level access to your cPanel account.

Note:

If you do not see these features, contact your hosting provider to enable them.

  • Terminal Access (SSH) — Add and remove SSH keys for secure remote shell access to your account.
  • Developer Access — Create and revoke API tokens that let scripts and tools authenticate to cPanel & WHM’s UAPI system.

To reach these tools, open the Security hub and select the Advanced tab.

Meridian Terminal Access SSH keys

Manage SSH keys

SSH (Secure Shell) is a network protocol that lets you connect to your server over an encrypted command line connection. To authenticate with an SSH key instead of a password, add your key under Terminal Access.

Generate a new SSH key pair

To create a new key pair on the server, perform the following steps:

  1. In the Advanced tab, in the Terminal Access (SSH) section, click Generate Key.
  2. Enter a name for the key.
  3. Enter and confirm a passphrase. A passphrase protects your server if an attacker gains access to the key. This step is optional.
  4. Click + Generate Key.
Important:

Store your private key and passphrase in a secure location. Anyone who obtains your private key and passphrase can access your account.

Import an existing public key

If you already have a key pair, you can import the public key instead of generating a new one:

  1. In the Advanced tab, in the Terminal Access (SSH) section, click Import Key.
  2. Paste your public key into the Public Key text box.
  3. Enter a name for the key.
  4. Click Import.

Delete a key

To permanently remove a key from your account, locate the key in the keys table and click the delete icon (). After you confirm, cPanel removes the key. You cannot recover a deleted key.

Manage API tokens

An API token lets an application authenticate with cPanel and run API functions on your behalf. Use API tokens for automated tools such as deployment scripts and continuous integration (CI) runners.

Important:

Treat an API token like a password. Anyone who has the token can perform actions as your account. API tokens can only perform account-level actions in cPanel.

Create an API token

To create a new API token, perform the following steps:

  1. In the Advanced tab, in the Developer Access section, click Create Token.
  2. Enter a descriptive name for the token. Use a name that identifies where you plan to use the token, for example backup-script or ci-runner.
  3. To limit how long the token remains valid, set an optional Expiration Date. If you do not set an expiration date, the token does not expire until you revoke it.
  4. Click + Generate Token.
  5. Copy the access token to a secure location. cPanel displays the token value one time only. If you lose the token, you cannot retrieve it and must create a new one.
  6. Click Done

Revoke an API token

Revoke a token when you do not need it anymore or if you believe an attacker has accessed it. After you revoke a token, any tool that uses it can no longer authenticate.

To remove an API token, perform the following steps:

  1. In the Advanced tab, in the Developer Access section, locate the token in the tokens table.
  2. Click Revoke for that token.
  3. Confirm the action.

Additional Documentation