Introduction
The licensing server is the single source of truth for every product you sell. One installation manages products, customers, licenses, activations, versions, downloads and security — and each of your PHP products talks to it through a small, stable API.
The model
Every request concerns one of four things:
- a product — a piece of software you distribute
- a customer — a person or company who buys it
- a license — permission for one customer to use one product
- an installation — one running copy of that customer's software
A license is issued in a single action and then activated once per running copy.
Base URL
All endpoints live under a version prefix:
https://license.example.com/api/v1v1 is frozen. When a breaking change is unavoidable, v2 is introduced alongside it and existing installations keep working untouched.
Endpoints at a glance
| Method | Path | Purpose |
|---|---|---|
| GET | /ping |
Liveness and server clock |
| GET | /products/{code}/public-key |
Signing keys for the SDK keyring |
| POST | /license/activate |
Register an installation |
| POST | /license/validate |
Decide whether software may run |
| POST | /license/deactivate |
Release an activation slot |
| POST | /license/status |
Read license state only |
| POST | /updates/check |
Is there a newer release? |
| POST | /downloads/request |
Get a temporary download URL |
| GET | /downloads/{token} |
Stream a package |
Design rules that never change
The server decides. A customer installation never decides for itself. It reports facts — its license key, domain, installation id, version — and obeys the answer.
A license key is not a credential. It identifies what is being authorised. Who is calling is established separately, with an API key and a request signature. See Authentication.
Deleting local state does not grant access. Removing a cached certificate forces an immediate re-validation. If the server cannot be reached, the installation is blocked once its grace window closes — it never fails open.
Offline is bounded, and the bound is server-controlled. Every successful validation returns a signed certificate valid for the product's grace period. The length of that window is decided on the server and travels inside the certificate.
Next
Read Authentication, then License API.
Page 1 of 8