Connect Blesta to Plesk for automatic subscription provisioning

The Blesta Plesk module is what turns paid orders into actual Plesk subscriptions — customer created, service plan applied, webspace provisioned, SSO link in the welcome email. It ships with Blesta core, but the field names are different enough from the cPanel module that a copy-paste of your WHM workflow won't land. Plesk uses customers and subscriptions instead of accounts, API keys instead of WHM-style tokens, and service plans instead of WHM packages.

This guide assumes Blesta 5.6+ and a Plesk Obsidian server you can sign into as the panel admin. If you're still on the cPanel side, the cPanel/WHM equivalent is the right starting point. For a side-by-side on the panels themselves, see cPanel vs Plesk.

Prerequisites

• Blesta 5.6 or later on a publicly reachable host with a valid Blesta licence.
• A Plesk Obsidian (18.0 or later) server with a current Plesk licence, Web Pro or Web Host edition. Web Admin won't expose the customer/reseller features the module relies on — see Plesk Web Pro vs Web Host if you're picking an edition.
• TCP 8443 open from the Blesta server to the Plesk panel.
• At least one Plesk Service Plan (Service Plans → Hosting Plans → Add a Plan) defining the disk, traffic, and feature set customers will receive. The plan name is the string Blesta will reference at the package level — note the exact name, case and spaces matter.
• The nameservers you want subscriptions assigned to, with A records that already resolve to the Plesk box.

Step 1 — Generate a Plesk API key

The Blesta Plesk module can authenticate with the admin username and password, but don't. A scoped API key is revocable, auditable, and doesn't lock you out of Plesk if you rotate the admin password later.

API keys live in the Secret Keys extension, which is bundled with Plesk Obsidian but not always pre-enabled. From the panel: Extensions → My Extensions → Secret Keys. If it isn't listed, install it from Extensions Catalog → Secret Keys (REST API) — free, official, takes about 10 seconds.

Once enabled, generate a key over SSH as root — there is no panel UI to create one, only to view existing keys:

plesk bin secret_key --create -ip-address 203.0.113.10 -description "blesta-provisioning"

Replace 203.0.113.10 with the Blesta server's public IP. The IP restriction is enforced at the API layer — requests from any other IP return 403 regardless of the key value. The command prints the key once. Copy it. Plesk stores the hash, not the key, so a lost key means a new key.

Step 2 — Install the Plesk module in Blesta

In Blesta admin go to Settings → Company → Modules → Available, find Plesk, and click Install. The module is bundled with Blesta core — no marketplace download or composer step.

The Plesk module provisions two service types from the same install: customer subscriptions (the common case) and reseller accounts. Which one a package creates is a setting on the package, not the module — install once, configure per package.

Step 3 — Add the server in Blesta

Go to Settings → Company → Modules → Plesk → Manage → Add Server.

Fill in:

• Server Label: e.g. plesk01-de-frankfurt. Surfaces in admin lists and is available in email templates as %server_name%.
• Hostname: the Plesk panel hostname, e.g. plesk01.example-hosting.com. Must resolve from the Blesta server — run dig +short plesk01.example-hosting.com on the Blesta box and verify the answer.
• Port: 8443. Don't use 8880 (the plain-HTTP variant) — the API key check tightens up on TLS and most production firewalls block 8880 anyway.
• Username: admin.
• Password: leave blank when using an API key.
• API Key: paste the key from step 1.
• Use SSL: tick. Always.
• Name Servers: enter the nameserver hostnames new subscriptions should use. Plesk applies these to the subscription's DNS template at creation time.

Click Test Connection. A green response means the panel returned 200 OK to a GET /api/v2/server request with the key. Red is almost always one of:

• DNS resolution — Plesk hostname doesn't resolve from the Blesta box.
• Port 8443 blocked — check iptables, firewalld, or Plesk's modsec / fail2ban setup hasn't auto-banned the Blesta IP after a few earlier failed test connections.
• Key not bound to this IP — re-run plesk bin secret_key --list and check the IP column matches the Blesta host. NAT or proxy in between will silently break this.
• Self-signed cert rejected — Blesta refuses invalid certs by default. Install a Let's Encrypt cert on the panel hostname (plesk bin extension --exec letsencrypt cli.php -d plesk01.example-hosting.com -m admin@example.com) and retest.

Save when the test passes.

Step 4 — Create a server group

Even with one Plesk box you need a group — packages can only reference a group, not a bare server.

In Plesk → Manage → Server Groups, click Add Group:

• Group Name: Plesk Shared DE
• Add Order: First non-full server is a sensible default. With one server it's a no-op; with many it spreads new subscriptions to whichever is below its configured account cap.

Add the server from step 3 to the group. Save.

Step 5 — Create the package

A package binds price and billing cycle to a service plan on a specific Plesk group. This is where most first-time setups go wrong because the Plesk plan name and the Blesta package name look interchangeable but mean different things — the Blesta package is what customers see, the Plesk plan is what gets applied to their subscription.

Go to Packages → Browse → Add Package:

• Module: Plesk
• Module Group: the group from step 4
• Module Row: leave on Auto
• Plan: pick the Plesk service plan name from the dropdown. Blesta populates this list by calling GET /api/v2/plans against the server — if the dropdown is empty, the panel returned an empty list. Confirm with plesk bin service_plan --list on the Plesk box; new plans created in the panel sometimes aren't visible to the API until a plesk repair web -y run.
• Reseller Plan: only set for reseller-type packages, leave blank for shared.
• Type: Standard for customer subscriptions, Reseller for reseller accounts.
• Use Domain Name: tick. The order form will ask for a domain, which becomes the subscription's primary webspace. Without it, you have to wire up a configurable option to capture the domain, which is more setup for the same outcome.

In the Pricing tab, set the cycle prices. The currency has to match a configured gateway — see Stripe or PayPal.

In the Welcome Email tab, the template can reference %username%, %password%, %ip_address%, %name_servers%, and %plesk_login_url%. The last one is a one-time SSO link Plesk generates per provisioning request — it expires in 10 minutes, so include it in the welcome email but don't store it.

Save the package and mark it Active.

Step 6 — Place a test order

Order the package as a client, mark the invoice paid as admin, then watch the provisioning happen:

tail -f /var/log/plesk/panel.log

On success you'll see subscription created with the customer and domain, and the service in Blesta flips from Pending to Active. The welcome email goes out with the SSO link.

If the service stays Pending, check Tools → Logs → Module in Blesta. Common errors:

• Login name already exists — Blesta derives the customer login from the domain; collisions surface on duplicate domains across customers.
• Domain already exists in the system — the domain is on another subscription, on this server or in a remote DNS slave.
• Plan does not exist or is unavailable — the plan name in the package no longer matches a plan on the server, usually because it was renamed in Plesk without re-saving the Blesta package.
• Failed to assign IP — the Plesk IP Pool has no shared IPv4 available. Add one in Tools & Settings → IP Addresses.

Step 7 — Suspension, termination, and SSO

Once subscriptions are creating, the rest of the lifecycle just runs — provided the cron is alive. See Blesta cron setup if you skipped it during install.

• Non-payment suspension — past the grace period from Settings → Company → Billing → Late Fees and Suspension, Blesta calls PUT /api/v2/subscriptions/{id}/suspend. The subscription's webspace returns the Plesk "subscription suspended" page until reinstatement.
• Cancellation — when the service date passes, Blesta calls DELETE /api/v2/subscriptions/{id}. The webspace is destroyed and the customer record is deleted if it has no other subscriptions.
• Upgrade/downgrade — package change in Blesta triggers a plan swap on the subscription via the change_plan endpoint. Disk and traffic caps update immediately; PHP version and other plan-bound settings propagate on the next site reload.
• Password change — from client area or admin, Blesta calls the customer update endpoint to set the new password. Doesn't reset webspace FTP user passwords by default — those are separate Plesk users.

The SSO link in the welcome email uses the POST /api/v2/clients/{id}/login_link endpoint, which returns a single-use URL valid for 10 minutes. The link logs the customer straight into their Plesk customer panel without showing a login form, which removes the most common support ticket of the first 24 hours ("how do I log in"). If you want SSO to keep working from the Blesta client area beyond the first login, enable Single Sign-On in Packages → Edit → Module Options.

Common failure modes after go-live

Welcome emails arrive without an SSO link. The template uses %plesk_login_url% but the package has SSO disabled. Either enable SSO at the package level or drop the SSO tag and rely on %plesk_panel_url% + username/password instead.

Subscriptions are created on a shared IP when you want dedicated. Plesk picks from the IP pool based on availability and the service plan's IP type. Edit the service plan in Plesk (not Blesta) and set IP address type to Dedicated, then make sure an unassigned dedicated IP exists in the pool.

Reseller orders create customer subscriptions instead. The Blesta package Type is set to Standard instead of Reseller. Change it and also set the Reseller Plan field — Plesk needs both a reseller plan and a customer-facing plan for the reseller's own subscriptions.

Provisioning works in test mode but fails in production. Usually Plesk's fail2ban jail has banned the Blesta IP after a few earlier API errors that looked like brute force. Check with fail2ban-client status plesk-panel and unban with fail2ban-client set plesk-panel unbanip <blesta-ip>. Whitelist the Blesta IP in /etc/fail2ban/jail.local under the [plesk-panel] section to make it permanent.

Service active in Blesta but no subscription in Plesk. The API call timed out after Plesk started but before it finished writing the subscription. Either it eventually completed (check plesk bin subscription --list for the domain) and you just need to refresh Blesta, or it rolled back and you need to manually retry from Service → Actions → Provision.

Next steps

• Wire up a payment gateway so paid orders trigger the module: Stripe setup or PayPal Standard.
• Make sure the Blesta cron is firing so suspensions and renewals run on schedule.
• Activate or renew your Blesta licence and Plesk licence before the first paying customer lands.