Use this order for a production domain: confirm the service entitlement, attach the domain, install the Help4 CDN plugin, complete DNS only when ready, and then use a per-site API pair for cache automation.
example.com, without a protocol, path, or staging hostname.Use the plugin and the DNS guide before changing nameservers, proxy records, or origin settings. Do not point a live domain at a new delivery path until the current site and mail records have been reviewed.
Open the API credentials section for the assigned domain in the authenticated Help4 Network client portal. Pro and Enterprise accounts can create multiple named standard keys. Each standard key accepts requests only from direct IPv4 or IPv6 values in enabled managed DNS records for that domain; MX records never authorize API access.
Enterprise accounts can also create one separate admin key. Select that type explicitly and bind it to one exact IPv4 or IPv6 address for the administrator's computer or approved automation host. The admin key is still tenant-scoped and cannot administer another client or the Help4 fleet.
The secret is shown only once. Help4 does not rotate or reset customer keys automatically. Use the portal's explicit reset or revoke action only when you intend to invalidate the existing secret. Enter the pair in WordPress Help4 CDN settings, save once, then run a small cache refresh test from an allowed address.
Store values in your deployment or automation secret manager, then pass them as environment variables. Replace the example domain and paths with the affected content.
export HELP4_API_KEY='YOUR_HELP4_KEY'
export HELP4_API_SECRET='YOUR_HELP4_SECRET'
curl -sS -X POST "https://example.com/wp-json/help4-cdn/v1/cache/refresh" \
-H "Content-Type: application/json" \
-H "X-Help4-Api-Key: ${HELP4_API_KEY}" \
-H "X-Help4-Api-Secret: ${HELP4_API_SECRET}" \
-d '{
"scope": "paths",
"paths": ["/", "/wp-content/uploads/updated-image.jpg"],
"reason": "publish-update",
"source": "deployment"
}'
For a planned full-site clear, use "scope":"domain" and "clearAll":true. Use the smallest path list that solves the problem when possible.
Reply to the active service ticket from the account that owns the CDN service if the portal reports a DNS-source or entitlement problem. Include the protected domain and the affected DNS record type, but never include the secret.