MagizAI for WHMCS: AI live chat for hosting companies

MagizAI is AI live chat built for web hosting companies. This module connects it to your WHMCS, so the assistant answers from your own plans, prices and help articles, and from the signed-in client's own account. Account answers are read from WHMCS at the moment the client asks.

What it answers for every visitor

• Help articles. Searches your knowledgebase and links to the article it answered from.
• Announcements and network status. What you have published, including open network issues.
• Plans and prices as cards. Each card shows the best-value billing term, its cost per month, the saving against paying monthly, the features and an order button. Plans that are out of stock say so.
• Domain availability. Checks a name and suggests other extensions when it is taken.
• Domain prices. Registration, renewal and transfer prices for every extension you sell, in the client's own currency once they sign in.

What it answers for signed-in clients

• Account overview. Counts first, then what needs attention: overdue invoices, services due soon, domains, open tickets and the credit balance. Large accounts are counted in full, never cut short.
• Services. Status, due date, server, and disk and bandwidth use.
• Domains. Expiry, nameservers, registrar lock and auto-renew.
• Invoices. Unpaid ones first, each with its pay link.
• "I paid, so why does it still say unpaid?" The payments WHMCS recorded against the invoice, and what each service on it is doing now.
• "My order is still pending." Whether each order is waiting for payment, for a payment to clear, or for setup.
• "When does it renew?" The next due date, roughly when the renewal invoice will arrive, and whether the service can be renewed early.
• "I never got the email." The date and subject of every email WHMCS sent the account, and whether any failed. Never what an email said.
• Support tickets. Open tickets and the latest staff reply.
• Upgrades and add-ons. What a service can move to, what that costs at WHMCS's own pro-rata price, and which extras are on offer.

Suspended at 2 AM? The chat can sort it out.

A client whose hosting is suspended doesn't have to wait for your team. The assistant tells them the service is suspended, names the overdue invoice behind it and gives them the link to pay. If that invoice is already paid and the service is still down, it passes the case to your team rather than guess.

Login details, in the chat or by email

"What's my cPanel password?" is one of the most common tickets a host gets. Signed-in clients can now get their own login details from the chat, with no ticket and no reset of a password that's already in use.

• One-click control panel login. For cPanel, Plesk, DirectAdmin, InterWorx and CyberPanel, the chat gives one link that opens the control panel through WHMCS's own single sign-on. No password needed.
• Username in the chat. For any of the client's own active services.
• Password by email. WHMCS sends it to the address on the account. This is what a new install does.
• Password in the chat, if you allow it. Switch on "show in chat" and the client confirms with a one-time code, then sees the password behind a reveal button. The button works once and expires after three minutes. The password never goes into the conversation, the saved transcript or the AI model.
• IPTV and streaming lines too. Usernames and passwords kept in product custom fields are found. Fields marked Admin Only are never read out.
• Getting started. How to reach the control panel, upload a website and set up email, pointing to your own setup guides for each device or app.

A password reaches the chat only when the client's sign-in was confirmed in the last 15 minutes, a window you can change; otherwise it goes by email. Login details go out at most three times an hour per account. Team members on an account get the password only if the owner gave them "View & Modify Product Passwords" in WHMCS.

What it can do once the client confirms

• Change domain nameservers.
• Turn domain auto-renew on or off.
• Open a support ticket, or reply to one.
• Place an order for a plan, with or without a domain.
• Upgrade or downgrade a service.
• Renew a service or a domain early.
• Add an extra to a service.
• Reset a control panel password and email the new one.
• Submit a cancellation request.
• Email a domain transfer code.
• Resend a welcome email or an invoice email to the address on the account.

Every one of these starts switched off. You pick which ones the assistant may use, and the client types a one-time code in the chat before any of them runs. Orders and renewals are checked against WHMCS first, so nobody is asked to confirm something WHMCS would refuse.

What MagizAI will never do

Take a payment

No card details in the chat, ever. An order creates the order and its invoice in WHMCS and returns your own pay link. The client pays on your checkout, through your gateway.

Show a domain transfer code

Transfer codes go by email, either to the address on the account or from the registrar to the domain's registrant contact.

Make up a price

Prices come from WHMCS in the currency the client is billed in, with no exchange-rate conversion. An order is priced again just before it's placed, so the invoice matches what the client agreed to.

Read out private details

Email history shows dates and subjects only, since welcome emails carry passwords. Fraud check results, card details and full payment references never reach the chat.

How MagizAI keeps your WHMCS secure

No WHMCS admin API key

MagizAI never stores or uses admin credentials. It talks to a narrow endpoint inside this module, which answers only the actions you've switched on.

Signed requests, signed replies

Every request carries an HMAC-SHA256 signature, a timestamp and a one-time nonce, and unsigned, expired or replayed requests are refused. Replies are signed as well, so MagizAI can tell a real answer from a login page or a proxy error.

Your WHMCS decides who is signed in

When a client opens a client-area page, the module signs a short-lived sign-in for them, 15 minutes on a new install. The chat refreshes it while the page is open. Once the client signs out, it stops working in every tab and on every device.

With PHP's sodium extension, the module can sign with an Ed25519 key that never leaves your WHMCS. MagizAI can check those sign-ins but cannot create them.

Clients see only their own account

Every service, domain, invoice and ticket is looked up under the signed-in client. "Not found" and "not yours" get the same reply, so nobody can use the chat to probe other accounts. Team members on an account see only what the owner allows them in WHMCS.

Staff sessions are recognised

Login as Owner and admin sessions count as staff, not as the client. An optional staff view lets your team check account answers read-only: changes are refused and nothing is emailed to the client.

Limits and logs

Ten account changes an hour per client by default, three login-detail sends and three resent emails an hour per account, and caps on domain lookups. Every request lands in the module's activity log and every change in the WHMCS activity log too. Clients get an email when their account changes. Passwords and transfer codes are masked in the WHMCS module log.

Quick setup

1. Upload the module to modules/addons/ and activate it.
2. Paste your MagizAI widget key and identity secret.
3. Generate the bridge secret and add it in MagizAI.
4. Tick the actions you want the assistant to use.
5. Choose where the chat appears: every client-area page, signed-in clients only, or your own embed code with the module adding just the sign-in.

No admin API key, no ionCube, no Composer. Updates keep your settings, secrets and action choices, and never switch on anything that changes an account or raises an invoice.

Requirements

WHMCS 8.0 or later (8.8 or later to renew a service early from the chat). PHP 7.4 or later. Outbound HTTPS. PHP's sodium extension for the optional Ed25519 signing key.

Support that doesn't clock off

Clients get real answers from their own account at any hour: presales questions, domain checks, billing, login details and changes to their services. Your team gets the conversations that need a person.