Licences your own systems can issue and check
What the API exposes
The same jobs the dashboard does, open to your own code.
Issue licences
Create a licence for a customer and a tier straight from your own order or sign-up flow, with no trip to the dashboard.
Validate keys
Check a key and a domain. The answer gives the seat status and the expiry date, so your installed software knows what to do next.
Suspend and terminate
Suspend a key after a chargeback, or end it for good. Either way, the reason is saved with the key so you can explain it later.
Audit history
Ask for every action taken on a key. Each entry shows who did it and when, so a support question gets a clear answer.
Replay-proof signing
Every request is signed over the method, the route, a timestamp and the body. A captured request cannot be sent again later to repeat an action.
Errors that explain
A refused call says why: an expired timestamp, an unknown key or no free seats. It never tells an unknown caller whether a licence exists.
How the licenses API fits your systems
The licenses API is the same API the dashboard calls. There is no second, weaker path for outside code. Anything you can do on screen, your own code can do too.
So you can issue a key when your own system takes an order. You can check a key before your software switches on. And you can revoke a key when a contract ends.
Signing, in plain words
Each request carries three headers: a key, a timestamp and a signature. The signature is an HMAC-SHA256 signature over the method, the route, the timestamp and a hash of the exact body. The server works it out again and refuses any mismatch.
The timestamp sits inside the signed text. So a request someone copies cannot be replayed an hour later. This keeps every licence check honest, even on a busy network.
Errors that say what happened
A refused call returns a status and a short message. It names the cause, such as an expired timestamp, an unknown key or a full seat count. It does not tell an unknown caller whether a given licence exists.
Keep your clock in sync
Requests outside the accepted time window are refused. Keep the calling server's clock roughly right, and the signatures will check out. You can rotate the signing secret in the Master Hub settings, then update your callers.
Key takeaways
- The licenses API is the same API the dashboard uses.
- Every request is signed, so copied requests are refused.
- Errors name the cause without leaking licence data.
- Every site pack includes the API.
Frequently asked questions
Is the API available on every tier?
Yes. The licenses API is part of the platform, not an add-on. Every site pack includes it.
How secure is the licenses API?
Every request is signed with HMAC-SHA256 over the method, the route, a timestamp and the body. A changed or replayed request is refused.
Can I rotate the signing secret?
Yes, from the Master Hub settings. Rotate the secret, then update the systems that call the API.
What happens if my server's clock is wrong?
Requests outside the accepted time window are refused. Keep the calling server's clock roughly in sync.
How do I get help if a call fails?
Read the error message first, because it names the cause. If you still need help, open a ticket on the support page and a person will reply.
Wire licensing into your stack
Every site pack includes API access and the full Master Hub.