Identify the token owner, name, creation time and integrations using it. Capture relevant access logs and the suspected exposure location without copying the secret into another public system.

1. Open Manage API Tokens under the appropriate WHM identity and locate the exact compromised token.
2. Choose Revoke and confirm. If the scope of exposure includes multiple tokens, assess each rather than assuming a password change invalidates them.
3. Check affected integrations and create narrowly permitted replacement credentials only after their configuration and secret storage are secure.
4. Review authorised logs and account changes for the exposure period, including account creation, password changes, sessions and new tokens where relevant.
5. Remove the exposed value from code or logs using the appropriate repository and incident process. Keep the revoked token revoked even if the visible copy is later deleted.

The exposed token should fail new authentication attempts, while approved integrations recover through newly secured credentials. Document what was checked and any suspicious changes requiring further investigation.

Revocation interrupts every consumer sharing that token. A single token per integration simplifies containment. If unauthorised activity continues, examine other credentials and persistence rather than repeatedly replacing only the same token.

No. cPanel documents that tokens can continue working after an account username changes. Explicitly revoke the credential when access must end.

• Rotating a WHM integration token with minimal interruption
• Enabling two-factor authentication for WHM administration
• Finding the owner, package and resource usage of a WHM account
• Changing a cPanel username and reviewing its dependencies

• cPanel: Manage API Tokens In Whm
• cPanel: The cPanel Log Files