Wir haben für Sie auf Deutsch umgestellt.View in English
Sprache: Deutsch
EnglishEspañolFrançaisDeutschPortuguês (Brasil)ItalianoNederlands
Mit uns sprechen
Doku

WHMCS-Addon

Addon installieren, Kundenidentitäten verifizieren und Abrechnungs­daten neben dem Chat anzeigen.

Diese Anleitung ist auf Englisch. Anleitungen folgen dem Produkt eng und ändern sich oft – deshalb pflegen wir eine genaue Fassung statt Übersetzungen, die hinterherhinken.

A drop-in WHMCS addon module (WHMCS 8.x and 9.x, PHP 7.4+) that embeds the IsTyping chat widget in the client area and tells IsTyping, with a signed identity, which client is chatting.

Install

  1. Copy modules/addons/istyping/ into your WHMCS install at <whmcs>/modules/addons/istyping/.
  2. Admin area: Configuration > System Settings > Addon Modules > “IsTyping Live Chat” > Activate.
  3. Click Configure and fill in:
    • IsTyping server URL (https://chat.example.com, origin only)
    • Website ID (UUID) and Identity secret, both from IsTyping > Settings > Install
    • Enabled / Show to guests / Send client context / Excluded pages
  4. Access Control: tick the admin roles allowed to open the module’s status page (it is only a status/test page; the widget itself needs no admin access). Save.
  5. Open Addons > IsTyping Live Chat to check status, see the exact snippet, and run “Test connection”.

No Composer, no database tables. Template-agnostic: it uses the ClientAreaFooterOutput hook, so it works with any theme that renders the standard footer hook output (Twenty-One, Lagom, etc.).

Two directions

  1. WHMCS to IsTyping (this module): the browser loads the widget and gets the client’s name, phone, segments, and a signed email. Needs the server URL, website ID and identity secret.
  2. IsTyping to WHMCS (WHMCS API): IsTyping calls includes/api.php to show services, domains, invoices and tickets beside the conversation and to open tickets. It matches the client by the visitor’s verified email. Needs an API Role + API Credentials + IP allow-list:
    • Create an API Role (Manage API Credentials) allowing: GetClientsDetails, GetClientsProducts, GetClientsDomains, GetInvoices, GetTickets, GetSupportDepartments, OpenTicket.
    • Create API Credentials (identifier + secret) tied to an admin and that role.
    • Add the IsTyping server’s public IP under General Settings > Security > API IP Access Restriction.
    • In IsTyping > Settings > Integrations > WHMCS paste the WHMCS URL, identifier and secret.

Identity verification

The module computes HMAC-SHA256(identity secret, lowercase(trim(email))) on the server and sends only the email and that signature to the browser; IsTyping recomputes it with the same secret and marks the visitor verified. Without the secret nobody can forge a verified identity, so a visitor typing someone else’s email cannot unlock that customer’s billing data.

Which identity: WHMCS 8+ lets one logged-in User manage several Client accounts. The signed email is the active client account’s email (what GetClientsDetails returns). If the acting User’s email differs it is added to session data as whmcs_user_email.

Emitted (logged-in client): user:email (verified), user:nickname, user:phone (if present), session:segments ["whmcs","client"], and with “Send client context”: session:data with only whmcs_client_id, company, country, client_status, client_since, active_services, currency, whmcs_user_email. Guests get segments ["whmcs","guest"] only. No addresses, payment data or notes are ever sent. Emails that contain non-ASCII characters are not sent as verified (PHP and the server may lowercase them differently). While an admin is “logged in as client” (masquerading) the widget is not rendered, so staff browsing never attaches to the client.

Logout: a logout hook sets a short-lived istyping_reset cookie, and the module also remembers the last client id in an istyping_cid cookie. The next page render emits $istyping.push(["do","session:reset"]) first if the flag is set, the visitor became a guest, or the client changed, so the next person on that browser does not inherit the previous conversation. Both cookies hold no secrets.

Upgrading from the old parley addon

Earlier releases of this addon were installed as modules/addons/parley/ (module name parley). The current addon is a separate module, so you install it next to the old one and then switch over:

  1. Upload modules/addons/istyping/ to <whmcs>/modules/addons/istyping/. Leave the old folder in place for now.
  2. Configuration > System Settings > Addon Modules > “IsTyping Live Chat” > Activate. Activation copies the server URL, website ID, identity secret, the options and the admin-role access from the old addon (the old addon’s settings are left as they are). If you have already configured the new addon, nothing is copied.
  3. Open Addons > IsTyping Live Chat and confirm the settings were carried over: the page says “Settings were carried over from the old addon” and “Configured and enabled”, and the snippet preview shows your server URL and website ID. If it says “Not configured”, enter the three values under Configure.
  4. Deactivate the old addon (it is in the same Addon Modules list, under its old name). From the next page view the chat widget comes from the new addon.
  5. Delete <whmcs>/modules/addons/parley/.

While both are active, the old addon keeps embedding the chat widget and the new one outputs nothing, so the widget is never loaded twice; the new addon’s status page shows “The old addon is still active” until step 4. If the old folder is deleted before the old addon is deactivated, WHMCS can no longer run it and the new addon takes over.

Customers notice nothing: conversations continue, and the new addon reads the old addon’s two cookies once (so someone who logged out during the switch still gets a fresh chat session), then replaces them with its own.

Troubleshooting

  • Widget not showing: module not Enabled; status page says settings missing/invalid or that the old addon is still active (see the upgrade steps above); page listed in Excluded pages; “Show to guests” off and not logged in; theme does not output {$footeroutput}; browser console shows l.js blocked (mixed content if the URL is http, CSP script-src/connect-src missing the IsTyping origin). Use the Test connection button to confirm WHMCS can reach IsTyping (note: it does not test the browser path).
  • “Unverified” badge in IsTyping: identity secret differs from IsTyping > Settings > Install (regenerated? stray spaces?), or the client has a non-ASCII email. Compare with php tests/demo.php <url> <id> <secret> <email>.
  • IsTyping shows no WHMCS panel / API errors: IsTyping’s IP is not in API IP Access Restriction; the API Role is missing one of the actions above; wrong identifier/secret; WHMCS URL has the wrong scheme/path. Check Utilities > Logs > Module Log / Activity Log.
  • Chat session persists after logout: cookies istyping_cid/istyping_reset blocked, or a full-page cache serves stale HTML to different users (exclude the client area from page caches).

Security notes

  • The identity secret never leaves the server (it is a password field, used only to compute signatures).
  • All values are JSON-encoded with JSON_HEX_TAG|AMP|APOS|QUOT, ASCII-only output (so U+2028/2029 cannot break scripts), invalid UTF-8 substituted; the script URL is built only from the validated app_url.
  • Treat the identity secret like a password: whoever has it can impersonate any customer in IsTyping.
  • Test connection only fetches the configured server’s /healthz and /api/v1/setup (admin-only, POST).

Uninstall

Deactivate the module (Addon Modules > Deactivate), then delete modules/addons/istyping/. Nothing else is created; users may keep two harmless cookies (istyping_cid, istyping_reset) until they expire.