Overview
Staff accounts cannot be bulk-imported from WHMCS. Because role structures differ and because it is best practice to issue fresh credentials on a new system, staff accounts are created manually one at a time.
This is typically a short task — most hosting companies have a small number of staff compared to their client base.
Creating Staff Accounts
- Log in to the Commerce admin panel.
- Go to Admin → Settings → Staff.
- Click Add Staff Member.
- Fill in the name, email address, and assign a role.
- Set a temporary password and communicate it to the staff member securely.
- Click Save.
Repeat for each WHMCS admin user.
Role Mapping
Map WHMCS admin roles to Commerce roles using the table below.
| WHMCS Role | Commerce Role | Access Level |
|---|---|---|
| Full Administrator | super_admin |
Full access to all admin functions including staff management, system settings, and destructive actions |
| Administrator | admin |
Full access except staff management and system-level settings |
| Support | support |
Client records, tickets, and service notes; no billing access |
| Billing | billing |
Invoices, payments, and financial reports; no provisioning or settings access |
[!TIP] When in doubt, assign a more restrictive role first and expand it later. It is easier to grant additional permissions than to audit over-permissioned accounts.
Password Handling
WHMCS stores admin passwords as bcrypt hashes. While bcrypt is technically compatible with Laravel's password hashing, migrating password hashes directly for staff accounts is not recommended.
For staff accounts specifically:
- Issue fresh passwords for all staff during migration.
- This is a good security hygiene practice when switching platforms.
- Communicate temporary passwords via a secure channel (e.g., encrypted email, 1Password shared item, or a direct message — not plain email).
Post-Creation Steps
After creating each staff account:
- Ask each staff member to log in and confirm access.
- Have each staff member change their temporary password on first login.
- Verify that role permissions match what they had in WHMCS.
- Check that staff members can see the areas of the admin panel their role permits.
Deactivating WHMCS Admin Accounts
Do not deactivate WHMCS admin accounts until after DNS cutover and the Commerce deployment is confirmed stable. You may need to access WHMCS to look up historical data or handle open tickets during the transition period.
[!IMPORTANT] If a staff member leaves the company during migration, remove them from both WHMCS and Commerce immediately to prevent orphaned access.