WHMCS Admin & Customer App
One installable app for clients and staff, straight over WHMCS.
- WHMCS addon module
- Version 0.40.0
- In development
Downloads are not open yet. This product is still in development — the button will go live when the first public release is ready.
A WHMCS addon module containing two things: a clean JSON API over your WHMCS data, and a progressive web app that consumes it. Clients sign in and get billing, support, services and domains. Staff sign in to the same app and get the ticket queue and a dashboard instead.
There is no app store, no per-app licence and no separate admin app to maintain. The app is plain ES2019 in a single file with no build step — upload the folder and it runs. Point a subdomain such as app.yourhosting.com at it and your customers have something that installs to the home screen and behaves like a native app.
The crypto is written into the module rather than pulled from Composer: JWT signing, VAPID, RFC 8291 push encryption and WebAuthn verification all live in lib/, and a command-line self-test proves they work on your server before you blame the configuration.
Inside the product
39 things WHMCS Admin & Customer App takes off your plate, grouped by the job they do.
One app, two audiences
The same shell serves customers and staff. Which one you get is decided by how you sign in, so there is nothing separate to install, brand or update.
Two tab bars, one build
Clients get Home, Billing, Support, Services and Account. Staff get Dashboard, Queue, Billing, Clients and You. Twenty-two screens in total.
Drill down from any figure
Tapping a headline number opens a focus-trapped sheet listing the rows behind it, rather than leaving you to guess what made it up.
Works when the network does not
The service worker serves last-known data offline, and a ticket reply written with no signal is queued and sent on reconnect.
Version-pinned caching
Caches are named after the module version, so bumping the version clears every stale app file on each device at next launch.
What customers get
Billing, support, services and domains, read live from WHMCS. No second customer database, no sync to go wrong.
Invoices and payment
Line items, tax, credit and payments taken. Paying hands off to your existing WHMCS payment page, so every gateway you already run keeps working.
Print or save as PDF
A single-use ten-minute link renders a printable invoice the browser turns into a PDF — no server-side PDF library to install.
The whole ticket thread
Read as chat bubbles, reply, attach files straight from the camera, and close your own ticket. Replying re-opens it.
Services with usage meters
Status, product, renewal date, amount, cycle and dedicated IP, with disk and bandwidth shown as bars rather than raw numbers.
Domains at a glance
Days to expiry in the list; registrar, renewal price, auto-renew, WHOIS privacy, transfer lock and nameservers in the detail.
One-tap cPanel
An active cPanel service shows a single Open cPanel button that signs the customer in with no password shown and no server privilege needed.
Outage notices up front
Open rows from your network issues list appear as a banner above everything else, so the ticket never gets raised.
What staff get
A mobile admin console covering the ticket queue, the numbers, and the actions genuinely worth doing from a phone.
Three-pane dashboard
Swipe between Income, Orders and Support, each with a sparkline and a one, two or four-week range control.
Queue with saved replies
Open tickets across every department, with your WHMCS predefined replies grouped by category and appended to the box rather than replacing it.
Staff-only attachments
Visibility is chosen per upload and defaults to staff-only, stored as a real WHMCS ticket note so the admin area treats it as private too.
Clients, searchable
Search name, company, email, phone or client ID, with outstanding balances shown in the list itself.
Reversible actions only
Suspend and unsuspend, toggle auto-renew, add credit, chase overdue invoices, accept or refund an order. Delete and terminate are deliberately absent.
Record a payment
Log a received payment against an invoice with the gateway listed, and a duplicate transaction reference is refused rather than double-counted.
Post an outage from the phone
Publish a maintenance or outage notice, optionally pushed to every client with notifications on, then mark it resolved.
Signing in
Passwords, passkeys and short-lived tokens, with sensible defaults that fail closed rather than open.
Passkeys, no library
WebAuthn registration and assertion verification are implemented in the module itself. Off by default; turn them on under Security.
Passwords keep working
Passkeys sit alongside passwords rather than replacing them, so switching them on cannot lock anybody out.
Two-factor accounts protected
A staff account with 2FA cannot sign in by password, and fails closed if the 2FA state is unreadable. Passkey enrolment is the way through.
Rotating refresh tokens
Fifteen-minute access tokens and thirty-day refresh, where a replayed token burns the session — with a grace window for the honest race.
App lock per device
Never, immediately, or after 1, 5 or 15 minutes. Locking genuinely ends the session and discards the tokens; unlocking is a real sign-in.
Rate limited throughout
Per-IP limits on login, refresh, ticket open, ticket reply, upload and push test, so a scripted attempt gets nowhere.
Notifications, branding and install
Real web push, a manifest generated from your branding, and an install QR code produced on your own server.
Push written from scratch
VAPID signing, ECDH key agreement and RFC 8291 payload encryption, needing nothing but the PHP openssl extension.
Four events that matter
Invoice created, invoice paid, invoice failed (marked urgent) and ticket reply — each guarded so a push failure cannot break the WHMCS action.
White-label throughout
App name, home-screen label, logo, icons, brand and accent colour, custom domain, and four colour schemes including a one-click pastel preset.
Manifest built from settings
Name, theme colour, three icons including a maskable one, and shortcuts to Invoices and Support are generated rather than hand-edited.
QR generated locally
The install QR is rendered as SVG in PHP, so no third-party QR service ever learns your client traffic. Downloadable at 1024px for print.
Promoted inside WHMCS
A client-area homepage panel shows the QR to desktop visitors and an Open the app button with iPhone instructions to mobile ones.
Invite customers by email
One at a time from any client screen, or in bulk in batches of a hundred, with a preview count, an already-invited skip and a test send.
Admin area and operations
Fourteen plain-PHP admin screens, documentation that cannot drift from the code, and eight command-line tools that check the things worth checking.
Five-step setup wizard
Check the server, choose the API admin, set identity and colours, pick features, then launch with a scannable QR and the remaining tasks listed.
Self-documenting API
The API reference table is generated from the router at render time, so it cannot fall out of step with what the code actually exposes.
Help tied to the controls
Forty-nine help topics across twelve sections, each versioned, with an inline "?" beside the control it explains and a New in this release strip.
Seven step-by-step guides
First launch, passkey rollout, install code, client onboarding, ticket workflow, billing flow and troubleshooting, each step linking to the screen it concerns.
Crypto self-test
Thirty checks that sign a token, sign a VAPID request, encrypt a push payload and decrypt it with a separately written reader. A pass means a real browser can read what you send.
A release gate
The version tool fails if the browser-facing files disagree with the module version, or if the changelog has no entry for it.
Diagnostics for sign-in trouble
A command-line check reports where a staff password is stored and in what format, and whether 2FA is the thing blocking the login.
Upgrades that keep state
Migrations are additive and idempotent, so settings, sessions and notification subscriptions all survive a version bump.
Hosting companies and agencies running WHMCS 8.0 or newer who want a real app without a native build.
What it needs
- Platform
- WHMCS 8.0 or newer
- PHP
- 8.0 or newer
- Transport
- HTTPS with a valid certificate
- Extension
- PHP openssl, for push and passkeys
What is coming next
- In-app payment sheet with Apple Pay and Google Pay
- Service control actions: reboot, clear cache, view live usage
- Multi-instance switching for agencies
- White-label native wrappers for the App Store and Play Store
Questions about WHMCS Admin & Customer App?
Every product is backed by the Keen2Support helpdesk. Customers raise tickets from inside the software itself, and replies sync straight back — no separate portal to remember, no password to lose.