WHMCS.Community

Thank you for sharing your feedback! Really glad to hear that the testing is going well and that you’re finding it simple to use. We’d appreciate any feedback you have as you continue testing it. It helps us improve the module further.

WHMCS AI Helpdesk Assistant v2.1.0 is now available We’ve just released v2.1.0 with new support actions, better chatbot controls, and improved WHMCS compatibility. 💬 When AI Isn’t Enough, Bring in a Human One of the biggest additions in this release is Slack Human Agent Escalation. Customers can now request help from a real support agent directly from the chatbot. When an escalation is requested, the conversation can be handed over to your support team in Slack, with a WHMCS support ticket created automatically. This gives support teams a simple way to move from AI assistance to human support without making the customer start the conversation again. What's New Slack Human Agent Escalation with automatic WHMCS ticket creation New chatbot actions for server password reset, server power management (start/stop/reboot), license reissue, Domain EPP code retrieval, Domain nameserver updates, and profile updates AI message rating with thumbs up/down Chatbot visibility: Everyone or Logged-in Clients Only Chatbot position, theme color, and Custom CSS settings Option to delete OpenAI data when the module is deactivated Improvements Improved module performance and database query handling Reduced OpenAI token usage with intent-based tool routing Improved language and localization handling Better Lagom2 compatibility and asset caching Improved setup wizard and existing installation detection Bug Fixes Fixed Lagom2 CSS and JavaScript conflicts Fixed module assets loading when the license is inactive Fixed cron execution and duplicate-run issues Version: 2.1.0 The update is now available for existing users. We’d love to hear your feedback, especially from those using the new Slack human agent escalation in their support workflow. Buy Now!  

I can only agree. We are testing it now and it looks really good and simple.

Agreed. Passkey authentication would be a very useful addition to the WHMCS core, especially as passwordless authentication is becoming more widely adopted. We’ve added this functionality through our Passkey Authentication Module for those who want to use it in WHMCS today.

Our 40% OFF sale is ending soon! If you have been planning to purchase a WHMCS module, theme, template, or any other product from our store, now is the time to take advantage of the offer. You can get a flat 40% OFF on all our products during the sale period. Thanks to everyone in the WHMCS community who has supported us over the years. We hope this offer helps you get the tools you need for your hosting business while saving a little along the way. Sale ending soon. Don't miss it! View All Our Deals

Support Pin Pro adds an extra layer of identity verification to your WHMCS installation by letting clients generate temporary, time-limited numeric PINs that your support team can verify over the phone, live chat, or support tickets. Instead of asking a customer to share a password or other sensitive account data, your staff simply ask for the support PIN displayed in the client's account. The PIN is verified instantly against the database, marked as used, and logged for a full audit trail — making account verification fast, secure, and fully transparent. The module is written against WHMCS's internal Illuminate Database Capsule, uses explicit Capsule::transaction() blocks for every multi-step state change, validates the WHMCS CSRF token on all state-changing requests, and escapes all output in its Smarty templates. The result is a module that is safe to run in production, simple for clients to use, and comprehensive enough for the busiest support desks. Buy Now for $45.00 - https://www.paypal.com/ncp/payment/FUUQXQX7N3Y88 The Problem It Solves When a customer contacts your support team by phone or live chat, you need a fast, reliable way to confirm they really are the account owner. Asking for a password is a security risk. Asking security questions is slow and frustrating. Emailing a code takes time and interrupts the conversation. Support Pin Pro solves this with a time-limited, one-use support PIN. Your client opens their client area, generates a fresh numeric PIN with the click of a button, and simply reads it out to your agent. The agent verifies the code instantly — no password shared, no sensitive data exchanged, no friction. When the conversation is over, the PIN is marked as used and can never be reused. What the Module Provides Support Pin Pro is a complete, enterprise-grade WHMCS addon module that delivers: A client-facing PIN portal — clients generate, view, copy, and revoke their own temporary support PINs with a live expiry countdown. A powerful admin suite — dashboard statistics, an all-PINs manager, a per-client PIN manager, and a searchable activity log. Instant verification everywhere your staff work — the dashboard widget, the support-ticket modal, and the client summary page. Sub-user support — account owners can grant PIN permission to their team members, with shared or per-user PINs. Full accountability — every generate, extend, terminate, delete, expire, and verify action is recorded in a detailed audit trail. Enterprise-grade engineering — PHP 8.1+ OOP, WHMCS's Illuminate Database Capsule, transaction-safe state changes, CSRF protection, and XSS-safe templates. The Lifecycle of a Support PIN Generate — A client (or sub-user) opens the Support PIN page and clicks Generate New PIN. The module creates a unique numeric code, stamps it with the current time, applies the configured expiry window (if enabled), and sets its status to active. If multiple active PINs are not allowed, any existing active PIN for that account is automatically expired inside a database transaction first. Share — The client reads the PIN to the support agent over the phone or in live chat. With copy-to-clipboard enabled, they can send it instantly in a chat window. Verify — The agent enters the code in the dashboard widget, the ticket modal, or the client summary card. The module looks the PIN up, checks its status and expiry, and returns a clear verdict: Valid — the PIN is active and within its expiry window. Used — the PIN was already consumed and cannot be reused. Expired — the PIN passed its expiry time. Inactive — the PIN exists but is not currently active. Not Found — no PIN matches the entered code. Mark as Used — After the conversation, the agent (or the configured workflow) marks the PIN as Used. This permanently prevents the code from being accepted again, closing the verification loop. Expire & Cleanup — PINs that reach their expiry timestamp are automatically flagged as expired by the daily cron. If enabled, expired PINs older than 24 hours are removed from the database entirely to keep the tables lean. Features Identity Verification Client-generated PINs — Clients create a unique numeric support PIN directly from their client area with a single click. No staff involvement is required for the client to obtain a code. Multi-surface verification — Staff can verify PINs instantly from three places: The dashboard verification widget — ideal for phone calls and live chat, no client context needed. The support-ticket modal — a "Verify Support PIN" button in the ticket interface that checks the code against the ticket's linked client. The client summary card — the current PIN and status are always visible when reviewing a client's profile. Clear verdicts — every verification returns one of: Valid, Used, Expired, Inactive, or Not Found, each with a distinct colour-coded result in the modal. Replay protection — PINs are marked as Used on explicit admin confirmation (configurable) so a verified PIN can never be accepted again. Full ticket workflow — the verify modal is pre-scoped to the ticket's client, so agents never enter the wrong account. PIN Lifecycle Management (Admin) Dashboard — live statistics at a glance: total PINs, active PINs, expired PINs, clients with PINs, generated today, verified today, plus a recent-activity feed and quick actions. Support Pins page — a searchable DataTable of every PIN across all clients, showing client, PIN code, live expiry countdown, status, created/expires timestamps, and actions. Clients page — search any client by name, email, or ID, then view and manage every PIN that client has ever had. Complete action set — per-PIN Generate, Extend (adds the configured hours), Terminate (immediately expires), Mark as Used, and Delete — every state change runs inside Capsule::transaction(). Client summary card — the native WHMCS client profile page gains a "Support PIN" panel with the current PIN, status, expiry, verify button, and a link into the PIN manager. Automatic hygiene — PINs auto-expire after the configured number of hours, and expired PINs older than 24 hours can be removed automatically by the daily cron. Client Area Dedicated Support PIN page — a clean, on-brand page showing the current PIN, expiry time, and a live countdown that ticks down to the second. Self-service — clients generate and revoke their own PINs through CSRF-protected forms, with clear success and error feedback. PIN History & Security Log — a table of every PIN generated for the account, including who generated it, the exact timestamps, status, and verification context. Role & permission context card — clients see whether they are the Primary Owner or a Sub-User, along with the capabilities available to them. "How verification works" guide — a friendly three-step explainer (Generate → Share → Get verified) that reduces support questions. Sidebar widget — an optional, positionable widget in the primary or secondary client-area sidebar with a live countdown, copy button, and show/hide toggle. Support menu link — an optional "Support PIN" entry under the client-area Support menu. Sub-Users & Permissions Granular permission — account owners grant sub-users access to Support PINs via the WHMCS Users & Permissions interface; a dedicated "Support PIN" permission is registered with WHMCS. Shared or individual PINs — each sub-user can have their own PIN, or share the account owner's PIN, depending on configuration. Owner notifications — the account owner is emailed whenever a sub-user generates a PIN, keeping the primary account holder informed. Clean UX — sub-users without permission see a clear "Support PIN access not enabled" message instead of a confusing error. Full Access accounts — accounts with full-access sub-users are handled correctly and given appropriate capabilities. Security & Audit Comprehensive Activity Log — records every action with client, user (sub-user name or "Owner"), action, detail, PIN code, status, and expiry. Human-readable actions — descriptive labels such as "PIN generated by staff", "PIN revoked by client", "PIN removed by cron job", and "PIN verification failed" replace cryptic raw strings. Failed attempts logged — invalid, expired, used, and not-found verification attempts are all written to the audit trail for security review. CSRF protection — every state-changing request (generate, extend, terminate, delete, mark used, revoke) validates the WHMCS CSRF token via check_token(). SQL-injection safe — all queries use parameter binding through the Illuminate query builder; no raw concatenated SQL. XSS-safe templates — all user and database values are escaped inside the Smarty templates. Hide PIN mode — optionally masks the PIN in the client area, revealing only the last two digits, while admins always see the full code. Copy to Clipboard — a copy button with visual feedback for chat-based verification. Emails & Notifications PIN delivery — optionally email the newly generated PIN to the client so they never lose it. Owner alerts — optionally email the account owner when a sub-user generates a PIN. Email preferences — per-client opt-out toggles are added to the WHMCS client profile for both the PIN email and the owner notification. Database & Maintenance Automatic setup — tables and default configuration are created automatically on activation; no manual SQL. Idempotent upgrades — the upgrade hook re-runs schema and seed routines so every version lands cleanly. Clean teardown — optionally drops all module tables and email templates when the module is deactivated. Changelog v2.0.0 New Features Complete admin UI refresh: modern cards, scoped CSS, FontAwesome icons, and consistent DataTables across pages. Redesigned Clients page: wide search bar, client overview card, full PIN display, text-labelled action buttons, empty states. Redesigned Activity Log: client, email, user, action, detail, and date columns; human-readable action descriptions; sub-user vs owner resolution; relative timestamps; failed-verification logging. Transaction-wrapped PIN mutations (createPin, extendPin, terminatePin, deletePin, expireUsedPin) using Capsule::transaction(). Failed verification attempts (including PIN-not-found) now written to the audit log. Cron job (expireExpiredPins / removeExpiredPins) now writes audit entries for auto-expiry and auto-removal. Admin profile links switched to clientssummary.php?userid= for reliable navigation. Full PIN codes shown to admins on the client management page regardless of the Hide PIN setting. Sub-user full names resolved in the audit log instead of raw emails or generic labels. Audit log ordered by primary key for stable newest-first display. Improvements fromMySQLDate() applied consistently to every displayed date in the admin and client areas (PINs list, client summary, audit, verify results, PIN history). DataTables pagination fixed so the selected page is clearly highlighted and hover states are correct across Support Pin. PIN History table displays formatted generated/expiry dates correctly. Sub-user badges on the admin PIN list restyled as compact muted text. PIN verification failures now produce a readable "Verify failed" action badge. Fixes PIN History "Generated At" / "Expires At" columns were blank — fixed by supplying formatted date keys from the API. DataTables pagination rendered all numbers the same colour — fixed in the module stylesheet. Verify-not-found attempts were not logged — fixed. Audit log rows could appear out of order — fixed by ordering on the primary key.

Hi all,   Apologies for the long wait on this one. It took considerably longer than we intended, and we know that was difficult for anyone working to a live compliance deadline. The WHMCS E-Invoicing addon module is now available. What it does: Exports the invoices WHMCS publishes to a certified Peppol access point, which generates the Peppol BIS Billing 3.0 (UBL/XML) document and exchanges it with the tax authority. No separate access point account or contract needed - that is included. Triggers when the invoice is published, not when it is paid. Generates a credit note automatically when you cancel an invoice that has already been exported, including partial credit notes. Adds an Invoice Management screen at Addons > E-Invoicing showing the status of every invoice, with a retry action for any that fail. Scope, so there are no surprises: Belgium only at this stage. Spain and France e-invoicing support will be added by the end of the year. Self-hosted WHMCS 9.0 or later. WHMCS Cloud is not supported. Access it from whmcs.com/e-invoicing

Yes, with one important distinction. The Open Source module is valid for life. You permanently retain the right to use the purchased module and its unencrypted source code, and the module does not stop working after 12 months. The initial purchase includes 12 months of access to new module releases and technical support. After that period, renewing this access is entirely optional. If you choose not to renew, you can continue using the latest version downloaded during your active update period. Access to future updates and support can be renewed later, when needed.

So just to confirm the lifetime owned license still requires payments after 12 months to keep the code up to date?      ie the lifetime license is for code that is current for only 12 months after purchase. 

Our Open Source deal just got better! 20% OFF → 25% OFF We have increased the global #PayJustOnce discount to 25% OFF across the ModulesGarden Open Source product range for WHMCS. Choose the modules your business needs, pay once, and keep them forever: ✅ Full access to the unencrypted source code ✅ Lifetime owned license ✅ 12 months of updates and priority technical support Already using one of our modules? The promotion also covers License Upgrades, allowing you to move to the Open Source version at the discounted price. Use code: #PayJustOnce ➡️ Browse Open Source modules: https://www.modulesgarden.com/products/whmcs