Requirements
What the module needs from your server and, more importantly, from your Porkbun account: verified email and phone, prepaid credit, the manual first registration, and API Access opt-in.
Two sets: what your server needs, and what your Porkbun account needs. The second set is the one that catches people out, because the module can be installed perfectly and still fail on the first registration.
Server and WHMCS
| Requirement | Notes |
|---|---|
| WHMCS 8.x | Uses the 1.1 registrar module API |
| PHP 7.2 – 8.3 | No version-specific syntax; runs on whatever your WHMCS runs on |
| cURL | Standard on any WHMCS host |
Outbound HTTPS to api.porkbun.com | Blocked outbound traffic is a common cause of “could not reach Porkbun” |
| Composer | Not needed. The module has no external dependencies |
Porkbun account
These are Porkbun’s own API rules. None of them are module decisions, and none can be worked around in code.
Email and phone must be verified
The API refuses billable operations on an unverified account. Verify both under your Porkbun account settings before testing.
The account runs on prepaid credit
Registrations, renewals and transfers spend account balance. There is no invoicing and no credit terms. If the balance runs out mid-month, renewals fail with INSUFFICIENT_FUNDS until it is topped up.
Turn on auto top-up. Porkbun supports it, and a registrar that cannot renew because the balance hit zero overnight is a bad morning. Porkbun also offers per-account monthly spend limits and low-balance alerts, both worth setting.
The API cannot place your account’s first ever registration
Porkbun blocks the very first registration on an account from the API as an anti-abuse measure. Register one domain manually in the Porkbun dashboard, once. Every registration after that can be automated.
If you skip this, your first WHMCS order will fail with an error saying the account must have placed a previous registration — which reads like a module bug and is not one.
Domains must be opted in to API Access
Porkbun has a per-domain “API Access” toggle. Renewals, DNS writes and nameserver changes are refused on domains that are not opted in.
Domains registered or transferred through the API are opted in automatically, so this only affects domains already in the account before you installed the module. The module’s daily sync notices and writes a note to the module log when it finds one that is not opted in.
API keys
Create them at porkbun.com/account/api. You get two values:
- an API key beginning
pk1_ - a secret API key beginning
sk1_
A sandbox key beginning pk1_sb_ runs the entire API against an isolated test environment with fake credit — same host, same endpoints, no real money and no real domains. Worth using for the first end-to-end test, including webhooks, which are delivered signed in sandbox too.
Rate limits
Defaults, and configurable per API key on request:
| Operation | Limit |
|---|---|
| Single availability check | 10 per 10 seconds, per account |
| Bulk availability check | 200 domains per 60 seconds, max 25 per call |
| Registration attempts | 1 per second, per account |
| Successful registrations | 1000 per 24 hours, per account |
These are comfortable for normal volumes. The module is built to stay inside them — renewal prices come from the cached TLD price list rather than a lookup per domain, and availability checks are batched 25 at a time.