Welcome Back!
Approval Rule
PENDINGToken exists, but external requests are rejected.
ACCEPTToken is active and may be used with the master API key.
REJECTToken is disabled and cannot be used.
How it works
- Reseller/Admin generates a token request.
- Owner reviews the request and chooses ACCEPT, REJECT, or DELETE.
- Only ACCEPTED tokens can call the external generation endpoint.
- Every API request must send both
api_keyandtoken. - The external website needs no SQL table; it only sends the request and displays the API response.
Security rules
The server checks:
- Master API key matches exactly.
- Token exists and status is ACCEPT.
- Token owner still exists, is active, and is reseller/admin.
- Invalid, pending, rejected, or deleted tokens cannot generate keys.
- External generation never reduces account balance.
PHP Request Example
<?php
$endpoint = 'https://test.ugi.my.id/panel/external-api/generate';
$apiKey = 'PASTE_MASTER_API_KEY_HERE';
$token = 'PASTE_ACCEPTED_TOKEN_HERE';
$payload = [
'api_key' => $apiKey,
'token' => $token,
'game' => 'MLBB',
'duration' => 1,
'max_devices' => 1,
'bulk' => 1,
];
$ch = curl_init($endpoint);
curl_setopt_array($ch, [
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => json_encode($payload),
CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'Accept: application/json'],
CURLOPT_RETURNTRANSFER => true,
CURLOPT_TIMEOUT => 30,
]);
$response = curl_exec($ch);
$httpCode = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
$curlError = curl_error($ch);
curl_close($ch);
if ($curlError !== '') {
die('Request error: ' . $curlError);
}
$result = json_decode($response, true);
if ($httpCode >= 400 || empty($result['success'])) {
die($result['message'] ?? 'API request failed.');
}
foreach (($result['keys'] ?? []) as $generatedKey) {
echo htmlspecialchars($generatedKey, ENT_QUOTES, 'UTF-8') . "<br>";
}
?>
Available Parameters
| Parameter | Required | Example | Description |
|---|---|---|---|
api_key | Yes | UGI_... | Master API key shown above. |
token | Yes | UGI_TK_... | Token generated by reseller/admin and ACCEPTED by owner. |
game | Yes | ALL | Manual game list used by the external API generator. |
duration | Yes | 1 | Manual duration in days: 1, 3, 7, 15, 30, 60, 90, 180, 365. |
max_devices | Yes | 1 | Allowed device count, 1–100. |
bulk | No | 1 | Number of keys to generate, 1–100. |