Create an Authorized cPanel Sign-On Session from WHM

cPanel/WHM temporary sign-on sessions let an already authorized administrator access an account without knowing its stored password. This is privileged delegation, not a password-recovery bypass available to anyone with an ordinary shell account.

Confirm authorization and scope

Use the least-privileged approved administrator route for the intended account and service. WHM’s List Accounts sign-on may be sufficient. API session creation requires the relevant WHM privileges; granting session-creation access can have broader consequences than a narrowly scoped integration token.

Documented API example

For an authorized administrator who has deliberately chosen this operation, the CLI form below requests a cPanel session for a placeholder account. Replace the account name only after confirming ownership and approval:

whmapi1 --output=jsonpretty create_user_session user=cpanel_user service=cpaneld

This creates authentication material; it is not a read-only diagnostic command. The equivalent WHM service is a different scope. Do not request a root session merely to manage a customer’s website.

Treat the returned URL as a secret

Check the result and intended HTTPS hostname/service. A returned session URL or token can confer account access: keep it out of public logs, chat messages, ticket attachments, browser sharing and analytics. Do not paste one into an external URL checker or bypass a certificate warning to open it.

cPanel documents expiry after inactivity and logout handling; do not assume a temporary link is harmless, permanently reusable or a replacement for token/session revocation. End the delegated session after the task and retain a non-secret audit record of the authorized action.

The old article’s sample root/customer session strings and insecure HTTP entry points have been retired. No live session is published here.

References: session-creation API; session privilege implications; single sign-on lifecycle.

Reviewed October 15, 2026. Example shell syntax/arguments checked only; no session or token was created.