Application API vs Client API

AryaPanel punya dua REST API terpisah dengan tujuan berbeda.

Client API

Untuk: user biasa mengelola server-nya sendiri.

Prefix: /api/client

Cara dapat token:

Account → API Credentials → Create New.

Token berformat: ptlc_XXXXXXXXXXXX

Kegunaan:

• Start / stop / restart server
• Baca / tulis file
• Buat backup
• Kirim command console
• Kelola database, allocation, subuser dari sisi server yang dimiliki

Scope: hanya server yang user tersebut punya akses (owner / subuser).

Application API

Untuk: admin panel mengelola sistem keseluruhan.

Prefix: /api/application

Cara dapat token:

Admin → Application API → Create New.

Token berformat: ptla_XXXXXXXXXXXX

Kegunaan:

• Create / delete server
• Create / delete user
• Kelola node
• Kelola allocation
• Kelola nest & egg

Scope: full admin, seluruh panel.

Kapan pakai yang mana?

Kebutuhan	API
Bikin dashboard buat customer	Client
Auto-scale, provisioning server otomatis	Application
Bot Discord yang jalankan command server	Client
Integrasi WHMCS / billing	Application
Widget resource usage di website	Client
Mass migration user	Application

Contoh: Discord bot restart server

Pakai Client API karena bertindak atas nama user tertentu:

const axios = require('axios');

await axios.post(
  'https://panel.aryapanel.xyz/api/client/servers/abc12345/power',
  { signal: 'restart' },
  {
    headers: {
      'Authorization': `Bearer ${process.env.CLIENT_KEY}`,
      'Accept': 'application/json',
      'Content-Type': 'application/json'
    }
  }
);

Contoh: auto-provisioning server dari billing

Pakai Application API karena bertindak sebagai admin:

await axios.post(
  'https://panel.aryapanel.xyz/api/application/servers',
  {
    name: 'Server Customer #123',
    user: newCustomerId,
    egg: 3,
    docker_image: 'ghcr.io/pterodactyl/yolks:java_21',
    startup: 'java -Xms128M -Xmx{{SERVER_MEMORY}}M -jar {{SERVER_JARFILE}}',
    environment: { SERVER_JARFILE: 'server.jar' },
    limits: { memory: 4096, swap: 0, disk: 20000, io: 500, cpu: 200 },
    feature_limits: { databases: 2, backups: 5, allocations: 1 },
    allocation: { default: 15 }
  },
  {
    headers: {
      'Authorization': `Bearer ${process.env.APPLICATION_KEY}`,
      'Accept': 'application/json',
      'Content-Type': 'application/json'
    }
  }
);

Security note

• Application key = root access ke panel. Simpan di .env server, jangan hardcode di repo.
• Client key juga sensitive tapi scope-nya terbatas ke server user tersebut.
• Rotate key kalau bocor: hapus di panel, generate baru.
• Batasi IP kalau bisa (fitur "Allowed IPs" saat generate key).