How each feature works — and how to automate it with the API
Public reference for customers and developers: step-by-step guides for each panel screen and the API route reference, with ready-to-copy examples.
Domains
Domains, subdomains and redirects
Each account has a main domain and can have addon domains (with their own folder), parked domains (pointing to the same site), subdomains and 301/302 redirects. Every new domain comes with a DNS zone and an automatic SSL certificate.
How to use it in the panel
Open Domains in the side menu and choose the type: addon, parked or subdomain.
Enter the name and, if needed, the site folder.
Wait for the status to change from “Provisioning” to “Active”.
To redirect, use Domains → Redirects.
When you delete a domain, everything that depends on it is permanently removed: folder, DNS zone, certificate and email accounts. The panel always asks for confirmation first.
G-Painel has its own authoritative DNS. You edit A, AAAA, CNAME, MX, TXT, SRV and CAA records with per-record TTL, and the panel publishes SPF, DKIM and DMARC for email.
How to use it in the panel
Open Domains → Zone Editor.
Choose the domain and click Add record.
Fill in type, name, value and TTL.
Save: the change is published within seconds.
Prefer Cloudflare? Connect your account under Domains → Cloudflare and manage your zones from there.
Connect one or more Cloudflare accounts with an API token. The panel lists your zones, lets you create and edit DNS records and set up health checks to monitor endpoints.
How to use it in the panel
In Cloudflare, create an API token with DNS edit permission.
In G-Painel, open Domains → Cloudflare and click Connect account.
Paste the token: the panel validates it and shows your zones.
Manage records and health checks directly from the panel.
The token is encrypted on the server and never shown again. Each Cloudflare account is isolated to the customer who connected it.
Create mailboxes with their own quota, forwarders, a catch-all account and autoresponders. Webmail runs on your own domain and anti-spam filters incoming messages.
How to use it in the panel
Open Email → Email Accounts and click New email account.
Choose the domain, the name and the password.
Set the quota in MB (or unlimited).
Use Set Up Mail Client to see the IMAP and SMTP settings.
Each domain gets its own certificate for IMAP and SMTP, renewed automatically.
Upload files by dragging them onto the screen with a progress bar, edit with syntax highlighting, compress, extract, change permissions and recover from the trash. FTP accounts with per-domain FTPS.
How to use it in the panel
Open Files → File Manager.
Drag files or folders from your computer onto the list.
Right-click to copy, move, compress or edit.
Deleted items go to the trash and can be restored.
The per-file upload limit is set by the administrator in WHM.
Make full account backups (files, email and databases) manually or on a daily, weekly or monthly schedule. Send them to the server itself, FTP, SFTP or any S3-compatible storage: Amazon S3, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces and MinIO.
How to use it in the panel
Open Files → Backup and add a destination (Local, FTP, SFTP or S3).
Under Automatic schedule, choose the frequency and time (UTC).
Set the retention: how many copies to keep (1 to 90).
To restore, choose the backup and click Restore — or upload a file from your computer.
A destination used by a schedule can’t be deleted. Copies beyond the retention are deleted automatically, including at the remote destination.
Install WordPress, Joomla, Drupal, PrestaShop, OpenCart, Zen Cart, Dolibarr, phpBB, Nextcloud and more in one click, on any domain, subdomain or folder.
How to use it in the panel
Open Software → App Installer.
Choose the app and the destination.
Enter the app administrator user.
The panel creates the database and installs the latest version.
Fail2Ban protects SSH, email and sites and automatically detects scans looking for sensitive files. The customer area includes an IP blocker, hotlink protection and directory privacy per domain.
How to use it in the panel
Open Security → IP Blocker to deny an IP or range access to your site.
Use Hotlink Protection to stop other sites from using your images.
Protect a folder with a username and password under Directory Privacy.
Review your open sessions under My Account and end any you don’t recognize.
Server-level blocks, trusted IPs and firewall events are managed by the administrator in WHM.
Create API keys with limited scopes to connect your systems to the panel. OAuth applications and webhooks, which notify your system when something happens, are configured by the server administrator in WHM.
How to use it in the panel
Open Advanced → Developer.
Create an API Key and select only the scopes you need.
Copy the key: it is shown only once.
Use it in the Authorization header of your requests.
Customer keys never receive server administration scopes.
Every route uses your G-Painel server address and a token in the Authorization: Bearer header — the login token, an API Key or an OAuth token. Create an API Key in the customer area under Advanced → Developer.
This page lists the routes for customers and API Keys. The complete documentation — including accounts, plans, firewall, webhooks, OAuth and server — is available and always up to date inside WHM, under Other → Documentation, for your G-Painel server administrator.
Area:
Customercustomer account or API KeyAuthenticatedany signed-in userPublicno sign-in⟳ asynchronousreturns provisioning
API route names and descriptions are in Portuguese.
Authentication
Login with a short-lived access token (15 min) and a refresh token that rotates on every use, instantly revocable sessions, scoped API Keys and OAuth client_credentials.
Asynchronous operations
Creating a site, mailbox or database returns provisioning. Poll the resource until it is active.
Idempotency and errors
Send Idempotency-Key to retry a create call without duplicates. Errors are always JSON, with a message in Portuguese.
Webhooks
16 events signed with HMAC, configured by the administrator in WHM. Verify the signature before trusting the message; failed deliveries can be resent.
Pagination and deletion
Lists accept limit and offset. Deleting a resource permanently removes everything that depends on it.
OpenAPI and Export for AI
The complete OpenAPI 3 specification and the “Export for AI” file — with rules and ready-made prompts for an assistant to build integrations — are in WHM, under Other → Documentation.