API documentation

How it works

1. Activate. The script sends the purchase code and its domain. We return a signed token holding what the licence grants.
2. Verify. On the interval you set, the script re-checks and a fresh token comes back.
3. Enforce. The token is signed with our private key and verified inside your script against the public key, so a normal check needs no network call at all.

Authentication

Two kinds of key, from your dashboard. They are not interchangeable.

X-Domzivo-Key: dmz_pk_your_key
# or
Authorization: Bearer dmz_pk_your_key

Quick start

Ship domzivo-license.php alongside your script and add this to your entry file:

<?php
require __DIR__ . '/domzivo-license.php';

$license = new DomzivoLicense(
    'dmz_pk_YOUR_PUBLISHABLE_KEY',   // Dashboard > API keys. Same for everything you sell.
    'YOUR_ITEM_ID'                   // The item's own page. Different for each item.
);

// Shows an activation screen if the buyer has not entered their code yet,
// and stops the script if the licence is not valid.
$license->guard();

echo "Licensed and running.";

Where the item id comes from

The id belongs to the item, so the item has to exist before there is an id to copy. That catches people out, because the id then has to go inside the zip you upload to that same item. Do it in this order and it is straightforward:

1. Create the item and save it as a draft. A draft needs only a title, so this takes a moment. You do not need the description, price, screenshots or the zip yet.
2. Open the Licensing panel on that item in your dashboard and press Copy. The id looks like 7c3f21a8-4d55-4e0b-9a1e-2f77b0c9d431.
3. Paste it into your script as the second argument, next to your publishable key.
4. Zip your script with the id already in it and upload that zip to the same item.
5. Finish the listing and submit for review.

To switch features on or off by tier, read what the licence grants:

$status = $license->check();

if (!empty($status['features']['branding_removal'])) {
    hide_footer_credit();   // Extended buyers can white-label it.
}

Errors & limits

Errors come back with the matching HTTP status and a readable message. The licensing endpoints are rate limited per IP.

Licensing API

Authenticated with your publishable key. These are the calls your shipped script makes.

{
  "purchase_code": "DMZ-XXXX-XXXX-XXXX",
  "domain": "buyerdomain.com",
  "product_id": "your-item-id",
  "environment": "production"
}

{
  "success": true,
  "valid": true,
  "token": "eyJhbGciOiJSUzI1NiIs...",
  "license": {
    "status": "active",
    "tier": "regular",
    "features": { "max_domains": 1 },
    "grace_until": null
  }
}

{
  "token": "eyJhbGciOiJSUzI1NiIs...",
  "domain": "buyerdomain.com",
  "product_id": "your-item-id"
}

{
  "success": true,
  "valid": true,
  "token": "eyJhbGciOiJSUzI1NiIs...",
  "license": { "status": "active", "tier": "regular" }
}

{
  "purchase_code": "DMZ-XXXX-XXXX-XXXX",
  "domain": "buyerdomain.com",
  "product_id": "your-item-id"
}

Vendor API

Authenticated with your secret key. Server side only, never from distributed code.

curl -H "X-Domzivo-Key: dmz_sk_your_secret_key" \
  "https://ourcodemarket.com/api/v1/vendor-api/verify?code=DMZ-XXXX-XXXX-XXXX"

Statuses

Offline & grace

Two values you set per product, on the item form in your dashboard:

• Check-in interval is how often the script revalidates. Between check-ins it verifies the token offline, with no network call.
• Offline grace is how long it keeps working when our API is unreachable, and how long a buyer keeps working after a licence is revoked.

Sensible defaults are a 48 hour interval with 10 days of grace. A short grace window is harsher on buyers with flaky hosting; a long one delays enforcement after a refund.

PHP SDK methods