Does your webmaster, agency or IT provider need to work on your hosting? Third-party access in the Apanel console gives them their own account, limited to the domains, services, mailboxes and databases you choose, without sharing your password. They log in with their email address, their password and a two-factor authentication code. You can change or remove their access at any time.
Before you give the first access, you must accept the terms of use once: the feature is meant to let someone work on your own sites, not to host other people's sites (see "Accept the terms of use" below).
Requirements
- A SwissCenter hosting account, and being the account holder: the Third-party access page is not offered to reseller accounts or to accounts limited to domain names.
- A plan that includes third-party access. If the Third-party access tab does not show in My account although you are the holder of a hosting account, contact SwissCenter support.
- Having accepted the third-party access terms of use (once, see below).
- A valid email address for the person you are giving access to: the invitation is sent to them directly, you never see it.
- The password of your Apanel account: it is asked when you invite a new third party.
- For the third party: an authenticator app on their phone (Google Authenticator, Microsoft Authenticator, etc.).
Good to know before you start
- The third party has their own account. They create their own password from the invitation link, and you never know it. The same third-party account can also work for several SwissCenter customers who gave it access.
- Delegated access has been replaced by third-party accounts, with the same rights. People who had a delegated access now log in through the Third-party access link of the login page.
- Two-factor authentication is mandatory for them. At the first login they must link an authenticator app, then enter a 6-digit code at every login.
- You choose exactly what they can do: the whole account or only some domains, and for each one the web, mail and DNS services, to view or to manage. You can even limit the access to some mailboxes or to a single database. Anything not explicitly granted is refused.
- They never have access to the "My account" page: they cannot change your password or your details, view your invoices, terminate the contract or invite other third parties. They cannot delete a domain either, or switch its services on or off.
- One access per email address and per account. To change what a third party can do, edit their existing access.
- Their actions are traced. Every change they make appears in Account activity, with a badge showing their email address.
- Choose the rights carefully. A third party who manages web, DNS or mail can act on sensitive settings (mailboxes, DNS records, FTP accounts). Only give this access to someone you trust.
- Third-party access is for your own sites. Hosting the site of another person or company on your account, even free of charge, is resale, which our general terms forbid (art. 16). A third-party access does not change that. See Individual account or Reseller account: what is the difference?.
Open the "Third-party access" page
- Log in to your Apanel console.
- Click My account at the top right.
- In the left menu, click Third-party access.
Accept the terms of use
As long as you have not accepted them, the Third-party access page first shows the Third-party access terms block, and the Add button is not offered.
- Read the text of the block. The Learn more link opens the article that explains the difference between an individual account and a Reseller account.
- Tick the box "I confirm that the sites of this account belong to me or to my company, and that I will not use third-party access to host other people's sites."
- Click Accept and enable.
A message confirms: "Terms accepted: you can now give third-party access." The block disappears and the Add button shows. If you click Accept and enable without ticking the box, the message "Check the box to accept the third-party access terms." is shown.
Good to know:
- You accept once per account. The acceptance is recorded with the date and your IP address, and a line appears in Account activity.
- If the terms change, the block shows again and you must accept them again to invite someone or change an access.
- Without acceptance, you can neither invite a third party nor change an access: the edit icon disappears from the list. You can still view the list, resend an invitation and revoke an access.
- Third parties who already had an access keep working: the acceptance only conditions new accesses and changes.
The list shows, for each third party, their address, their Access, their State, their Last login and their Expiry. Revoked accesses are no longer listed.
Invite a third party
- Click Add, at the top right of the list. The Invite a third party window opens.
- Fill in the Email address of the third party.
- Choose the Scope, then the accesses (details below).
- If needed, set the Options (end date, SSH keys).
- Enter your password in Confirm with your password, then click Invite and send the link.
A message confirms: "The invitation was sent to …". The third party receives an email with a link to create their account, valid for 7 days. If the address belongs to a third-party account that is already active, the access is active at once and the third party is told by email.
Scope: the whole account or selected domains
| Scope |
What it covers |
| Whole account |
Every domain of your hosting, including the ones you add later. |
| Selected domains |
Only the domains you tick in the list. For each one, you set the three services below. |
Services and roles
For the chosen scope, three blocks let you set each service. In every block, the list offers No access, View or Manage. With the Whole account scope, it also offers Manage the account.
| Service |
What it covers |
| Web services |
Website, FTP accounts, SSL certificates, statistics, web redirections, subdomains, domain aliases, directory protection and applications. |
| Mail services |
Mailboxes, mail forwards, mailing lists, mail filters and DKIM. |
| DNS services |
The DNS zone and dynamic DNS. |
| Role |
What the third party can do |
| View |
See the settings of the service, without changing anything. |
| Manage |
View, change and delete in this service. Managing SSH keys is not part of it (see the options). |
| Manage the account (whole account only) |
Managing its services, plus scheduled tasks (cron), the file manager, every database, the Valkey cache and adding a domain. |
An account with the Manage the account role holds a lot of power: a message reminds you of it when you choose Whole account.
Under each service, the Exceptions link opens a table (View, Change, Delete) to add or remove one precise permission from the chosen role, for example Manage without deleting FTP accounts. Changing the role resets the table.
Special cases
- The databases of a domain. For the web services of a domain, the Include the databases of this domain box is ticked by default: the third party also reaches the databases linked to this domain, with the same role. The names of those databases are shown under the box.
- Some mailboxes only. In the mail services block, the Mailboxes list offers Every mailbox, Only the ticked mailboxes and All but the ticked mailboxes. An excluded mailbox does not show for the third party: neither in lists nor by its direct address. A mailbox created later is included with "Every mailbox" and "All but", not with "Only".
- DNS without mail. If the third party manages DNS without managing every mailbox, the mail-related DNS records (MX, SPF, DKIM, DMARC) stay read-only for them. A message then shows in the window.
- A single database. Under Databases, a table lists every database with its Linked domain: choose View or Manage for the database you want. This is the only way to give access to a database that is linked to no domain.
Options: end date and SSH keys
| Field |
What to enter |
| Valid until (empty = unlimited) |
Optional. The access stays usable until the date shown. Leave it empty for an access with no time limit. The date cannot be in the past. |
| SSH keys |
The Allow this third party to manage SSH keys: I have read the warning above switch, after reading the warning shown above it. An SSH key gives access to the web content of every domain of the account, including the site files and the database credentials they hold, but not to the mailboxes. This option needs access to the web services. |
What the third party does
- They open the link received by email. They land on the Activate your third-party access page.
- They choose their password, confirm it, then click Create the password.
- On the Turn on two-factor authentication page, they scan the QR code with their authenticator app, enter the 6-digit code it shows, then click Turn on and log in.
- Their session opens in your space. A Third-party access: their address on your account banner shows at the top of the screen.
Next times, they go through the Apanel login page: the Third-party access link on that page opens the third-party login. They enter their email address and password, then the 6-digit code from their app. They can tick Remember this device for 30 days: the code is no longer asked on that device, but the password still is.
- Several accounts. If they work for several customers, a Choose an account page lists them at login, and the Switch account link stays available at the top of the screen.
- My access. A click on the banner at the top of the screen opens the My access page: for each hosting account, it lists the scope, service, role and expiry of their rights. Only the account holder can change them.
- Lost security code. If they lose their phone, they must contact SwissCenter support, who can reset their two-factor authentication after checking their identity. They will then link a new app at their next login.
After several wrong codes in a short time, the login is locked for a while, even with the right code.
Change an access
- In the list, click the first icon of the row, Edit a third-party access.
- Change the scope, services, roles, end date or SSH keys.
- Click Save.
This window does not ask for your password. Changes apply from the third party's next action in the panel. To change a third party's email address, revoke their access and invite the new address. The edit icon is only offered if you have accepted the terms of use.
If an access covers both the whole account and selected domains, a message warns you: when you save, only the access to the whole account is kept.
Resend the invitation
The second icon, Resend the invitation, only shows while the third party has not activated their account (Invitation sent or Invitation expired in the State column). Use it when the email is lost or the link has expired. It stays available even if you have not accepted the terms.
- Click the Resend the invitation icon of the row.
- Confirm the question "Resend the invitation to …?".
A new link, valid for 7 days, is sent by email, and the previous link stops working.
Revoke an access
- Click the last icon of the row, Revoke the access.
- Confirm the question "Revoke the access of …?".
The third party loses every access to your hosting at once. Their third-party account stays usable for the other customers who gave them access. Your Account activity keeps the trace of what they did. Revoking stays possible without having accepted the terms.
If the third party created FTP accounts or SSH keys on your hosting, the window lists them and offers Delete them too (on by default). Leave this option on to remove, in one go, everything that would let the person come back.
Troubleshooting
| Message or situation |
What to do |
| The Add button and the edit icon do not show, and a Third-party access terms block is displayed |
Read and accept the terms: tick the box, then click Accept and enable. |
| "Check the box to accept the third-party access terms." |
Tick the confirmation box before you click Accept and enable. |
| The Third-party access tab does not show in My account |
Your plan does not include third-party access, or your account is a reseller account or is limited to domain names: contact SwissCenter support. |
| "The access was saved but the invitation email could not be sent. Use "Resend the invitation"." |
The access does exist: click Resend the invitation. |
| "This third party already has access to your hosting account: change it from the list." |
Edit the existing access from the list, with the first icon. |
| "This email address is not accepted." |
Use a plain address, without quotes, spaces or special characters such as < or >. |
| "This third-party account was disabled by support." |
Contact SwissCenter support if you want to give it access. |
| "Choose at least one access: a service on the account or on a domain, or a database." |
Set at least one service to a role other than No access. |
| "Choose at least one service for … , or untick this domain." |
A ticked domain must have at least one service, otherwise untick it. |
| "Choose at least one mailbox of …" |
With Only the ticked mailboxes or All but the ticked mailboxes, tick at least one mailbox. |
| "SSH key management needs access to the web services." |
Give a role on the web services, or untick the SSH keys option. |
| "The validity date cannot be in the past." |
Choose a date from today on, or leave the field empty. |
| "The selection is no longer valid" |
A domain, mailbox or database was deleted meanwhile: close the window and start again. |
| The third party sees "Invalid invitation link" |
The link is invalid, already used or expired: use Resend the invitation. |
| The third party sees "Your third-party access has ended" |
Their access was revoked or their end date has passed: they must ask you for a new access. |
| The third party sees "This code was already used. Wait for the next one." |
They must wait for their app to show the next code, then enter it. |
| The State column shows "Expired" |
The end date has passed: the third party can no longer log in. Change the date to reactivate the access, or revoke it. |
| The State column shows "Disabled by support" |
The third-party account was suspended by SwissCenter: contact support. |
Need a more restricted access?
If your webmaster only needs file transfer and a database, you can also create a limited FTP account and MySQL access for them: see Creating limited FTP and MySQL access for a webmaster.