1. Document the integration's purpose, owner, required API methods and outbound IP addresses. Determine whether it needs only to read information or also create and modify billing records.
2. Open Settings > Security Settings > API Access in HostBill. Add a named access record with a useful description and appropriate status.
3. Restrict the allowed IP address or subnet where practical. An empty restriction allows requests from any source address, subject to valid credentials.
4. Set an expiry when appropriate for the integration's lifetime. Leave Undeletable off for routine credentials so they can be removed through the interface when retired.
5. Generate the API ID and API Key. Review allowed methods immediately: HostBill documents all methods as initially enabled. Disable that broad selection and allow the specific functions the integration requires.
6. Store the credentials in the integration's protected secret configuration. Use the API documentation and collection for the installed version, then test a permitted read operation before any write workflow.

Review the API Usage log for the expected function, API identity, caller address and result. Test that a disallowed function fails in a controlled environment. Establish how the integration reports errors and how its credentials will be rotated before expiry.

Allow getHostBillversion for a test API identity and restrict it to your authorised caller. Replace the example HTTPS address with your HostBill API address. Store the API ID and key in private files outside the web root, each containing only its value with no trailing newline, readable only by the operator.

curl --fail --silent --show-error --request POST \
  'https://billing.example.com/admin/api.php' \
  --data-urlencode 'api_id@/private/path/hostbill-api-id' \
  --data-urlencode 'api_key@/private/path/hostbill-api-key' \
  --data-urlencode 'call=getHostBillversion'

This sends credentials in the POST body while leaving certificate verification enabled. Check the JSON response for success: true, the installed version and the expected API log entry. It should not create or alter a customer service.

Expected result: authentication, allowed method and caller restriction are verified with a documented read operation before enabling the integration's required write workflow.

• Give HostBill staff appropriate administrator permissions
• Use HostBill logs to investigate an operational failure
• Move HostBill to another server or installation address
• Manage test accounts and credentials for billing integrations

• HostBill API access
• HostBill staff and staff team privileges

• HostBill HTTP API
• HostBill getHostBillversion