Partnerships & WHMCS Integration

Last updated: May 3, 2026 · Describes how authorized reseller partners work with ImpactGuard and optional WHMCS automation.

ImpactGuard may onboard authorized partners (typically hosting providers, communities, or integrators) who resell or bundle licenses. This page explains the commercial relationship, the partner-facing panel, and the optional WHMCS server module / hook workflow that posts completed sales to ImpactGuard for commission accounting. It supplements our Terms of Service, Privacy Policy, and Refund Policy.

Not an open public offer. Partnerships are established only after ImpactGuard provisioning (admin-created partner profile, API credentials, and agreed revenue share). Nothing on this page obligates us to approve a specific applicant.

Partner program (summary)

  • Profile: ImpactGuard operators create a partner record with company details, contact email, configurable revenue share percentage, and a partner API key used for automation.
  • Partner panel access: Partners may receive a dedicated partner role login to view aggregated stats and commission lines attributed to their account.
  • License attribution: Licenses can be assigned to a partner so future renewals and reporting align with that relationship.
  • Commissions: Commission rows are created when qualifying revenue events are recorded (including via the WHMCS webhook below). Amounts may be pending until ImpactGuard marks them paid according to internal payout processes.

WHMCS module & webhook

Partners who bill customers through WHMCS (WHMCS Limited’s billing platform — third-party software independent of ImpactGuard) may use an ImpactGuard-oriented server module or hook that notifies our API when a sale should generate partner commission data. The integration is HTTP-based and must be configured on the partner’s WHMCS installation.

Endpoint

POST to:

https://impactguard.xyz/api/partners/webhook/whmcs-sale

(Use your production host if different; TLS is required in production.)

Opening this URL in a browser only sends GET. That is for discovery only. WHMCS (or curl tests) must send POST with JSON — otherwise nothing is recorded.

Authentication

Each request must include header x-whmcs-webhook-secret with a value that matches the WHMCS_WEBHOOK_SECRET configured on the ImpactGuard panel server. Requests without a valid shared secret receive 401 Unauthorized. Rotate secrets if you believe a key leaked; coordinate with ImpactGuard operations.

Request body (JSON)

The webhook expects a JSON body including at least:

  • Partner resolution (one required): partner_id (numeric ImpactGuard partner id), or partner_api_key (the partner_… key), or partner_email matching the partner contact email on file.
  • Reference (required): invoice_id or order_id — used for idempotency so duplicate posts for the same WHMCS invoice/order update the same commission row instead of multiplying payouts.
  • Amount (required): amount — positive number for gross sale amount in the transaction.
  • Optional: license_key (binds or confirms license attribution), currency (defaults toward USD if omitted), commission_percent or commission_amount (otherwise derived from the partner’s configured share and gross amount).

On success, ImpactGuard records or updates a commission with source whmcs and stores the raw payload in operational metadata for auditing. Malformed, duplicate, or fraudulent posts may be rejected or reversed; partners are responsible for correct WHMCS-side configuration and for lawful billing to their own end customers.

Partner responsibilities

  • Accuracy: Only send webhook calls that reflect real completed payments you are entitled to attribute, with correct amounts and references.
  • WHMCS compliance: You remain responsible for your WHMCS deployment, tax invoices, consumer disclosures, and any refund or chargeback policy between you and your customers — separate from ImpactGuard’s direct Refund Policy for purchases through our panel.
  • Security: Protect API keys and webhook secrets; restrict server module files and hook scripts from public download.
  • Brand & claims: Do not imply unauthorized endorsement; describe ImpactGuard capabilities consistent with public documentation.
  • Lawful use: Comply with applicable laws (including marketing, export, and sanctions rules) in every territory where you operate.

Changes, suspension, and termination

ImpactGuard may change partner tooling, revenue share defaults for new deals, webhook fields, or eligibility criteria with reasonable notice when practical. We may suspend or end a partnership for breach, risk to the platform, abuse of the webhook, or commercial wind-down. Surviving payment obligations for already-accepted commission rows are handled case-by-case in line with Terms.

Governing law

Partner relationships are governed by the same Republic of Bulgaria framework and dispute rules described in our Terms of Service, without prejudice to mandatory rights under EU or Bulgarian law.

Contact

Partnership inquiries and technical coordination: [email protected] · Support page