compute

POST `/v1/panels/connections/{connectionId}/login-link`

One-click login — a one-time administrative session on the panel.

Authentication

Send an API key as a bearer token. The key must carry the sites.panel_access permission; a key without it is refused with 403, not 404.

This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.

Try it

Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.

curl -X POST https://api.zinndigital.com/v1/panels/connections/{connectionId}/login-link \
  -H "Authorization: Bearer zdk_live_…" \
  -H "Content-Type: application/json" \
  -d '{  }'

Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console

Details

⚖️ The owner's ask of 2026-08-28, verbatim: "one click login to the plesk panels". ⛔⛔ The returned url is a LIVE CREDENTIAL. It is an authenticated administrative session on the customer's panel. It is never logged, never persisted and never emailed — it is returned to one authenticated caller and belongs straight in their browser. Plesk's links are single-use and die on first redemption, which is a stronger guarantee than any expiry clock; expiresAt is therefore absent rather than guessed. ⛔ Gated on sites.panel_access — not sites.view. That key means direct server-level access to a customer's hosting: it is held by owner, dev and staff ops, and deliberately not by support or any read-only role. A read-only role must never be able to mint an administrative session. ⛔ Answers 422 when this connection has not proved it can create login links, and refuses BEFORE calling the panel. A button that reaches a panel which will refuse it fails on a third-party domain, where neither we nor the customer can see why. Every mint is written to the audit trail with the actor and the panel — never the URL.

Parameters

Name	Type	Required	What it is
`connectionId (path)`	`Uuid`	Yes	The connected panel's id, as `listPanelConnections` reports it.

Request body

Name	Type	Required	What it is
`username`	`string`	No	A panel user to sign in as. Omit for the panel's administrator.

Response

Name	Type	Required	What it is
`url`	`string`	Yes	The one-time login URL. Treat it as a secret.
`username`	`string`	Yes	Which panel user the session belongs to. Empty means the administrator.
`single_use`	`boolean`	Yes	Whether the link dies on first use. ⛔ `null` is unknown, and a client must not promise single-use on the strength of it. Plesk's are single-use, which is a stronger guarantee than…

Errors this endpoint can return

401 · 403 · 404 · 422 · 429 · 503

POST /v1/panels/connections/{connectionId}/login-link