Sell credits from your own panel

1Requirements

2Connect DHRU Fusion

Settings → API Providers → Add API Provider

Test the connection

Use Account Info / Balance. Expected result:

{"SUCCESS":[{"MESSAGE":"Account info retrieved successfully","Credit":"250.00",
 "AccoutInfo":{"mail":"you@example.com","username":"yourname","credit":"250.00","currency":"Credits"}}],
 "apiversion":"5.1"}

Credit is your available balance.

Import services

Click Sync Services. You will see one group, Credit top-up, with one service:

The customer picks the quantity: an order for 25 costs you 25.00 and gives the customer 25 credits. Set your own selling price per credit in DHRU (for example 15 % margin → sell 1 credit for 1.15 in your currency). Panels that synced the older fixed packs (service IDs 200 – 50000) keep working; sync again to switch to the single service.

Each service asks for one custom field: Username or email of the customer's Shadow Auth Tool account.

How an order flows

1. The customer orders credits, chooses the quantity and enters their username or email.
2. DHRU calls placeimeiorder. The credits move immediately.
3. The order is Success (status 4) with the text "10 credits were added to the account alice - check your account on https://shadowauthtool.com". Your panel shows this to the customer.

3Protocol reference

All calls: POST, form-encoded (JSON body also accepted).

parameters can be sent as XML:

<PARAMETERS><ID>1000</ID><IMEI>alice</IMEI><REFERENCE>order-8841</REFERENCE></PARAMETERS>

or JSON {"ID":1000,"IMEI":"alice","REFERENCE":"order-8841"}. Direct integrations may instead send plain form fields (customer=alice&amount=5).

Success: {"SUCCESS":[{...}],"apiversion":"5.1"} Failure (HTTP 200): {"ERROR":[{"MESSAGE":"...","FULL_DESCRIPTION":"code"}],"apiversion":"5.1"}

Actions

fileservicelist, providerlist, modellist and mepkeylist return empty lists so panel syncs don't fail.

Examples

# Balance
curl -s https://shadowauthtool.com/api/dhru \
  -d username=YOURNAME -d apiaccesskey=hurs_xxxxxxxx -d action=accountinfo

# Send 25 credits to a customer (safe to retry: same reference never charges twice)
curl -s https://shadowauthtool.com/api/dhru \
  -d username=YOURNAME -d apiaccesskey=hurs_xxxxxxxx \
  -d action=transfer -d customer=alice -d amount=25 -d reference=inv-2026-0042

# DHRU-style order for 10 credits (service 100, quantity 10)
curl -s https://shadowauthtool.com/api/dhru \
  -d username=YOURNAME -d apiaccesskey=hurs_xxxxxxxx -d action=placeimeiorder \
  --data-urlencode 'parameters=<PARAMETERS><ID>100</ID><QNT>10</QNT><IMEI>alice</IMEI><REFERENCE>order-8841</REFERENCE></PARAMETERS>'

Idempotency – important

Always send a REFERENCE/reference (your order id). Repeating a call with the same reference returns the original order and never charges again. Reusing a reference with a different customer or amount is rejected (reference_conflict). Without a reference a retried request is treated as a new order.

4Rules and limits

• Customers are found by exact username or email. The customer does not need a verified email; the username is enough. Disabled, administrator and reseller accounts cannot receive credits; you cannot credit yourself.
• Maximum per transfer: 1,000 credits (can be raised by your administrator).
• Amounts have at most two decimals and must be positive.
• Orders fail with insufficient_credits if your available balance is too low – nothing is deducted.
• Rate limit: 240 requests / minute per IP. Ten failed authentications within five minutes block that IP for five minutes.
• Up to 5 active API keys; accounts you create with createuser (up to 5,000) are marked as yours.

5Troubleshooting

6Security

• Treat the API key like a password. Never put it in public code, customer-facing pages or support tickets.
• Pin the key to your server's IP and revoke/recreate it if you suspect a leak (Portal → API access → Revoke).
• Every transfer is recorded in an append-only ledger and visible in Recent transfers in the portal.
• Reseller sign-in always requires your authenticator code; keep your recovery codes offline.