A question that comes up often enough to answer properly: do you have to write PHP to sell here? No.
The SDK is a convenience, not a requirement
We publish a PHP SDK because most items on the marketplace are PHP, and it saves those sellers an afternoon. Underneath it, the API is plain HTTPS and JSON. Anything that can make an HTTP request can use it.
What the SDK actually does for you: builds the request, verifies the signed token, caches it, and fails in the right direction when the network is down. Worth knowing, because those are the four things to implement if you write your own.
The shape of it
Your item collects the buyer's purchase code, sends it with your API key, and gets back whether the licence is valid, which tier it is, whether support is running, and a signed token to hold on to. That is the whole interaction.
By stack
- Node, Python, Go, Ruby: a plain POST. Twenty lines including the error handling.
- Laravel, Symfony: the PHP SDK drops straight in.
- WordPress: the SDK, or WordPress's own HTTP functions if you would rather not ship a dependency into somebody else's plugins directory.
- Desktop and mobile apps: same API, but call it from your own server rather than from the app, so your key is never inside something a user can open up.
One rule wherever you call it from
Your API key is a secret. Server side, in an environment variable or a config file outside the web root. Never in client-side JavaScript, never in a mobile binary, never committed to a repository, never inside the zip you distribute.
Use a separate key per item, and a separate one for staging. Keys are free, and when one has to be revoked you then revoke exactly one thing.
Where to start
The API documentation shows the raw request and response next to every SDK example, so you have what you need whichever way you go.
