📡 API Documentation

Integrate secure license validation into your application.

🔐 Authentication

All license API calls use JSON over HTTPS and require these headers:

  • X-License-Secret — shared installation API secret.
  • X-License-Key — the license key being checked.
  • X-License-Timestamp — current Unix timestamp.
  • X-License-Signature — HMAC-SHA256 of license_key|timestamp|raw_json_body using the per-license secret.

Sign the exact JSON bytes sent in the request. Timestamps outside the permitted window are rejected.

✅ Validate License

POST https://www.license.webinpocket.com/api/license/validate

JSON body

{
  "license_key": "SINV-XXXX-XXXX-XXXX",
  "domain": "billing.example.com",
  "webhook_url": "https://billing.example.com/webhook/license/invalidate",
  "webhook_token": "YOUR_RANDOM_WEBHOOK_TOKEN"
}

Success response (200)

{
  "valid": true,
  "status": "active",
  "message": "License is valid.",
  "plan": "Enterprise",
  "expires_at": "2027-08-31"
}

🔑 Activate License

POST https://www.license.webinpocket.com/api/license/activate

Use the same authentication headers and send license_key and domain in the JSON body.

⚡ Rate Limits

API requests are limited to 60 requests per minute per IP. Excess requests return 429 Too Many Requests.

💻 Signed PHP Example

$licenseKey = 'SINV-XXXX-XXXX-XXXX';
$licenseSecret = 'YOUR_64_CHARACTER_LICENSE_SECRET';
$timestamp = (string) time();
$body = json_encode([
    'license_key' => $licenseKey,
    'domain' => $_SERVER['HTTP_HOST'],
], JSON_UNESCAPED_SLASHES);

$signature = hash_hmac(
    'sha256',
    $licenseKey . '|' . $timestamp . '|' . $body,
    $licenseSecret
);

$ch = curl_init('https://www.license.webinpocket.com/api/license/validate');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
        'X-License-Secret: YOUR_INSTALLATION_API_SECRET',
        'X-License-Key: ' . $licenseKey,
        'X-License-Timestamp: ' . $timestamp,
        'X-License-Signature: ' . $signature,
    ],
    CURLOPT_POSTFIELDS => $body,
]);

$data = json_decode(curl_exec($ch), true);