License keys

License keys are issued automatically for products with license keys turned on, one key per paid order. You can validate keys from your own app and revoke them at any time.

Issuing

Tick Issue a license key with each order when creating the product (API: license_enabled: true on POST /api/products). On every verified paid order a key is issued and stored as a salted hash — the plaintext key is only ever shown to the buyer, in the purchase email.

Validating via the API

Public endpoint, no auth required — call it from your software:

curl -X POST https://YOUR_HOST/api/licenses/validate \
  -H 'Content-Type: application/json' \
  -d '{"key":"THE-LICENSE-KEY"}'
# -> { "valid": true }   or   { "valid": false }

The response is always { "valid": boolean } — unknown and revoked keys are indistinguishable (no enumeration).
Rate-limited to 20 requests/minute per IP.

Managing keys

The License keys card on your dashboard lists every issued key (prefix, product, buyer, status) with a Revoke button. The same over the API:

# List your keys (seller session required)
curl -b cookies.txt https://YOUR_HOST/api/licenses
# -> { "keys": [ { "id": "...", "keyPrefix": "...", "status": "active",
#      "orderId": "...", "issuedAt": "...", "revokedAt": null } ] }

# Revoke a key
curl -b cookies.txt -X POST https://YOUR_HOST/api/licenses/KEY_ID/revoke
# -> { "revoked": true }

The list shows only safe fields — key prefix, status, order reference, and dates. Plaintext keys and full hashes are never exposed. Revoking a key that doesn’t exist (or belongs to another seller) returns 404 { "error": "not_found" }.

Revocation on refund

When Stripe reports a refund on your connected account, the buyer’s license keys are revoked automatically along with the download entitlement.