Documentation

API Reference

{
  "status": "success",
  "message": "License validation successful"
}

{
  "status": "error",
  "message": "License validation failed"
}

{
  "message": "Domain is required.",
  "errors": {
    "domain": ["Domain is required."]
  }
}

curl -X POST https://licensify.mkbuilds.live/api/validate-license \
  -H "Accept: application/json" \
  -d "license_key=XXXX-XXXX-XXXX-XXXX" \
  -d "domain=example.com"

$response = wp_remote_post($url . '/api/validate-license', [
    'timeout' => 15,
    'body'    => [
        'license_key' => $license_key,
        'domain'      => parse_url(home_url(), PHP_URL_HOST),
    ],
]);
$code = wp_remote_retrieve_response_code($response);
$body = json_decode(wp_remote_retrieve_body($response), true);
$valid = ($code === 200 && isset($body['status']) && $body['status'] === 'success');

What works today

Implemented

The following items from the production checklist are already in place:

• ✓ Input validation — license_key and domain validated via Form Request
• ✓ Domain normalization — Strip protocol, path, port; lowercase; www stripped so www.example.com = example.com
• ✓ Stricter rate limiting — 10 requests per minute per IP on /api/validate-license
• ✓ Generic error messages — Single “License validation failed” for all failure cases; detailed reason logged server-side
• ✓ Auto-generate license keys — In Filament Create License, leave key empty to get format XXXX-XXXX-XXXX-XXXX
• ✓ WordPress client helper — docs/wordpress-license-client.php with caching and clear usage
• ✓ Activation audit log — license_activations table; every validation (success/failure) logged; viewable in Filament per license
• ✓ API documentation — This page
• ✓ Automated tests — Feature tests for valid key, invalid key, expired, inactive, domain mismatch, domain normalization, validation errors

Remaining gaps

Consider adding these for production or commercial use:

• License deactivation / transfer — Customer moves site; license is bound to old domain. Add “Deactivate” or “Reset domain” in admin, or customer-facing deactivation with verification.
• Product / version support — Single product only. Add product_id or product_slug to licenses and optional product param on validate for multi-product licensing.
• Updates endpoint — Add GET /api/check-updates?license_key=...&domain=...¤t_version=... returning latest version and download URL if valid (for plugin update checks).
• Customer self-service portal — Let customers view their licenses and deactivate for transfer (e.g. login with license_key + email or integrate with store).

Nice-to-have (later)

WordPress integration checklist

To use this server with a WordPress plugin (e.g. M-Pesa plugin):

1. Add license settings in the plugin: license key input, “Activate” / “Deactivate” buttons.
2. On activation: POST to https://licensify.mkbuilds.live/api/validate-license with license_key and domain (from site_url() or parse_url(home_url(), PHP_URL_HOST)).
3. Cache result (transient, 12–24h) to avoid repeated API calls.
4. Gate features: If validation fails, show “License required” and limit functionality.
5. Optional: Periodic re-validation (e.g. weekly cron) or on plugin load.

Use the provided docs/wordpress-license-client.php helper: instantiate with your API URL and product slug, call validate($license_key, $domain), and optionally clearCache() on deactivation.

Recommended priority order

If you are implementing remaining items, this order is suggested:

1. Input validation — Implemented
2. Domain normalization — Implemented
3. Stricter rate limiting on validate — Implemented (10/min)
4. Generic error messages — Implemented
5. Auto-generate license keys — Implemented
6. WordPress client helper — Implemented
7. Activation audit log — Implemented
8. API documentation — Implemented
9. License deactivation / transfer
10. Automated tests — Implemented