Reseller API

For panels that resell VPS instances on top of this provider. Sign up downstream customers and report credit-bearing events so the parent panel keeps a true picture of revenue.

Overview

Base URL: https://<your-panel-host>. All paths under /api/v1/reseller. Reseller keys carry one or both of: reseller:signup, reseller:credit.

Reseller keys are minted by the panel owner from the Admin → API keys tab. The owner picks the owner_email (the reseller's account on this panel) — that account becomes the audit-trail attribution for every call this key makes.

Issuing keys

Only the panel owner can mint reseller-scoped keys. Owner POSTs to /api/admin/api-keys with scopes: ["reseller:signup", "reseller:credit"].

Authentication

Authorization: Bearer vfc_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

POST/api/v1/reseller/signupreseller:signup

{
  "email": "customer@example.com",
  "name": "Customer Name",
  "password": "at-least-8-chars"
}

Creates a user on the parent panel. The new account's signed_up_via field records the issuing key. Idempotent on email — returns 409 if the user already exists.

// 200
{ "ok": true, "id": 124, "email": "customer@example.com" }

Report a credit event

POST/api/v1/reseller/credit-eventreseller:credit

Push an event when a downstream user pays the reseller. The parent uses this for revenue reconciliation. external_ref deduplicates retries.

{
  "kind": "topup",
  "amount_usd": 25.00,
  "external_ref": "txn_abc123",
  "meta": { "downstream_user": "customer@example.com" }
}

// 200
{ "ok": true, "id": "ev_..." }

Re-posting the same external_ref from the same key returns { "ok": true, "duplicate": true } — safe to retry.

Anti-scam contract

The reseller-credit channel exists because the parent does not trust the reseller to silently keep revenue off-book. Three rules to keep your integration in good standing:

Every billable customer event must be reported. Top-up, plan purchase, renewal. Use external_ref to dedupe.
Never delete events on either side. The parent retains the event log and reconciles against your panel's ledger. Mismatches trigger an account review.
Treat reseller keys like merchant secrets. Rotate immediately on any suspicion of compromise — the owner can revoke from the admin panel.