# Resellers > Sell hosting on your server through somebody else: an organisation with its own administrators, its own accounts and its own ceilings, that never sees the server or its neighbours. Source: https://www.corepanel.net/docs/resellers/ Last updated: 2026-09-10 Part of the CorePanel documentation — https://www.corepanel.net/docs --- A **reseller** is an organisation that sells hosting on your server. It has its own administrators, who sign into the same panel you do — narrowed to the accounts that organisation owns, with everything about the machine taken out. It is the answer to the question a growing provider eventually asks: *how do I let an agency, a partner or a franchise sell space here without giving them my server?* > **CorePanel Business** > > Creating a reseller, and creating an administrator under one, requires > [CorePanel Business](https://www.corepanel.net/pricing). Resellers that already exist keep working on any > edition, keep being narrowed, and only *new* ones are refused — a licence that lapses > must never widen what somebody can see. ## The model, in one picture ![The server, owned by the primary vendor, with two resellers under it side by side — Northwind Hosting and Bluewave Studios — each with its own administrators and its own list of hosting accounts, and a third column of accounts the vendor sells directly. A dashed line from one reseller across to its neighbour's accounts is crossed out and labelled 'never visible'.](https://www.corepanel.net/_astro/reseller-ownership.Ns1Ks3PZ.svg) Three things this diagram is saying, and each of them is a rule: - **Every hosting account has exactly one owner.** Either a reseller, or the organisation that runs the server — what the panel calls the *primary vendor*, and what every account belongs to on a server with no resellers at all. - **One level, always.** A reseller has customers, never other resellers. There are no sub-resellers and none are planned; a reseller who wants to resell wants their own server. - **A reseller never sees the neighbour.** Not their accounts, not their domains, not their mailboxes, and not the fact that they exist. This is enforced by the server on every request, not by hiding things in the panel — the same code path answers a request from the panel, from the command line and from the API. ## Creating one **Resellers**, next to Accounts in the panel, is where they live. It is visible to super-administrators on Business, and to nobody else. ![The Resellers screen: a table with one row per reseller showing the name and contact address, the accounts sold against the allowance, the disk sold against the ceiling with an Overselling tag, an Active status pill, and per-row buttons for administrators, edit, suspend and delete. A New reseller button sits above the table.](https://www.corepanel.net/_astro/reseller-center-dark.D_YF1gUS.png) **New reseller** asks for four things: | Field | What it does | |---|---| | **Name** | How you refer to them, and what their own administrators see on their panel. Must be unique, compared without regard to case. | | **Contact address** | Where this reseller is notified about their own customers' events. | | **Accounts** | How many hosting accounts they may own in total. `0` means no limit. | | **Disk** | How much disk they may sell in total, in MB. `0` means no limit. | A reseller with no administrator can do nothing at all — the row exists and nobody can sign in as it. Use the **administrators** button on the row to create the first one: username, email and an initial password they are required to replace the first time they sign in. > **Creating the first login is the moment it becomes real** > > Everything a reseller can do, they can do from the moment somebody can sign in for > them. If the reseller came from a [cPanel migration](https://www.corepanel.net/docs/cpanel-transform), CorePanel > also warns you here when the source panel had granted them a *restricted* set of > privileges: there is nowhere to put a partial grant, so the login you are handing out is > wider than the one they had on the old server. It is not an error — you may well intend > it — but you should know you are doing it. The same operations exist on the command line: ```bash corepanel seller list corepanel seller create "Northwind Hosting" --email billing@northwind.example \ --max-accounts 25 --max-quota 2048000 corepanel admin create northwind --seller "Northwind Hosting" --email ops@northwind.example ``` See the [CLI reference](https://www.corepanel.net/docs/cli) for the full set. ## The ceilings, and what they refuse The two limits are **totals across everything the reseller owns**, and they refuse rather than decorate: creating an account past either one is rejected, with a message naming the wall it hit. What is counted is what was **assigned**, never what is being used. A reseller with a 2,000 GB ceiling who has sold four 500 GB accounts is full, whether those customers have uploaded anything or not — because that is what they sold, and the alternative is a limit that moves on its own and suspends provisioning at three in the morning because somebody's mailbox grew. Two consequences worth knowing before you set a number: - **A reseller with a disk ceiling cannot be given an account with no quota.** An unlimited account adds nothing to the total, so a single one would exempt them from the ceiling for ever without ever exceeding it. Accounts that are *already* unlimited — every reseller imported from cPanel arrives with some — are counted separately and shown beside the total; they do not block anything, because that is a state the import created and not one the reseller chose. - **The ceiling is the reseller's, not the caller's.** You creating an account for a full reseller is refused exactly as they would be. A limit the operator can step over by hand is a limit that stops applying the moment billing automation runs as you. **Allow overselling** lifts the *disk* ceiling only — it is cPanel's `enable_overselling_diskspace` under a clearer name, and the account limit was never part of it there either. ## What a reseller's panel looks like The same panel, recut. Their administrators get the accounts they own and the things that live inside them; everything whose subject is the machine is gone. ![The dashboard a reseller's administrator sees: the eyebrow reads 'Reseller overview', the title carries a Northwind Hosting badge, and two cards show 3 hosting accounts of 25 allowed and 1,504 GB of disk assigned of 2,000 GB. The sidebar has eleven entries and none of the server-wide ones.](https://www.corepanel.net/_astro/reseller-dashboard-dark.CNj3b5J2.png) | They keep | They do not get | |---|---| | Accounts, and everything inside one — domains, subdomains, mailboxes, databases, FTP, cron, backups of an account | The server dashboard: disk, load, memory, service health, web traffic | | Suspending and reinstating their own customers, and turning a customer's panel login on or off | Suspending anything they do not own, and every restore: recreating an account is the server owner's | | DNS records for their own domains | Server settings, the setup wizard, the account importer | | SSL certificates for their own domains | The host firewall, access protection, the server logs | | WordPress installations on their own accounts | The WAF's own rules and its event log — its whole monitoring half | | WAF exceptions and trusted IPs *per domain* | API tokens, agent tokens, the licence, PHP versions | | Hosting packages: their own, plus yours | Anything at all about another reseller | | Notifications about their own customers | Support requests to CorePanel about this server | **Suspension is theirs to use.** A reseller whose customer has not paid suspends that customer exactly as you would, with the same effect on every plane and the same reason field — recorded for whoever reads the audit trail, and naming the reseller's administrator rather than you. What they cannot do is suspend anything outside their own organisation, or reinstate an account somebody else suspended. Their dashboard is a different screen rather than yours with the tiles removed: every number on the operator's dashboard is the machine's, so what replaces them is the only aggregate a reseller has — what they have sold, against what they may sell. ## Seeing who owns what Once the first reseller exists, **Accounts** gains a **Reseller** column and a filter beside the search box. The column names the reseller that owns each account, or says *Direct* for the accounts you sell yourself; the filter narrows the list to one reseller, or to the accounts sold directly. ![The Accounts overview on a server with two resellers. Beside the search box a select reads 'All owners', and the table has a Reseller column between User and Public HTML directory: securepanel.dev shows Bluewave Studios, while edge-corepanel.net, northgate-books.com, harborlight.app and the other accounts the server sells itself read 'Direct' in a dimmer tone.](https://www.corepanel.net/_astro/accounts-reseller-column-dark.raCvAhFO.png) Both are for the server's own administrators. A reseller's administrators only ever see their own accounts, so there is nothing for them to tell apart — and asking the server for a neighbour's accounts answers an empty list, not an error. A server with no resellers shows neither. The filter lives in the address — `/accounts?seller=12` — so a filtered list can be bookmarked or sent to a colleague. ## Moving an account between owners Ownership is the only thing that changes. No service restarts, no site is interrupted, the account keeps its own limits, and its past notifications stay with the reseller that owned it when they happened. In **Accounts**, the **transfer** button on the row (two opposing arrows) asks for the new owner: any reseller, or **This server (sold directly)** to take the account back. A suspended reseller is listed but cannot be picked — an organisation that is not trading cannot take on customers. The same operation on the command line: ```bash corepanel account transfer east-region.cloud --to "Northwind Hosting" ``` The destination's totals go up exactly as if the account had been created there, so a transfer into a full reseller is refused. The account's **hosting package reference is cleared**, because a package belongs to a seller: the limits it already has stay untouched, but it is no longer described by a plan the new owner does not have. The dialog warns you before you confirm when the account is on a package. An account that is down **because its reseller is suspended** cannot be moved until you reactivate it: moving it would hand the new owner a customer they have no way to bring back. Reactivate that one account from the list, then transfer it. ## Suspending a reseller Suspending a reseller stops the organisation trading: every hosting account it owns goes down with it, and its administrators can no longer sign in. Their customers see exactly what a suspended account's customer always sees — the same suspension page, the same rejection on mail. **The reason you type is yours**: it is recorded on the reseller row and shown to you, never to the reseller and never to the people whose sites just stopped. Lifting it brings back **exactly the accounts that suspension took down**. An account somebody had suspended on its own merits before — for abuse, for non-payment to the reseller — stays down, which is the whole reason the panel records which ones it was responsible for. ## Deleting one Deleting a reseller never cascades. Cancelling a contract is not a reason to delete somebody's customers' hosting, so the deletion is refused while the reseller still owns anything, and the message names what is holding it: transfer their accounts to another owner (or to yourself) first, then remove the reseller. Removing a reseller's administrator removes a *login*, and nothing else — the hosting accounts belong to the organisation, not to the person who created them. ## What is not here yet - **A reseller cannot issue API tokens**, so they cannot point their own WHMCS at this server. Provisioning through [WHMCS](https://www.corepanel.net/docs/whmcs) is the server owner's, and an account created through it can be given an owner with `owner=` — see that page. - **The WAF's monitoring half is server-wide**, so a reseller sees no events for their own customers' sites yet, only the per-domain exceptions and trusted IPs. - **Support access**: a reseller cannot log in as one of their own customers. That button belongs to the server owner today.