Do I have to use PHP?

No. We publish a PHP SDK because most items here are PHP, but the API is plain HTTPS and JSON. Anything that can make an HTTP request can use it.

What the SDK actually saves you

It is a convenience, not a requirement. It handles the request, verifies the signed token, caches it, and fails in the right direction when the network is down. Writing that yourself in another language is an afternoon, and the documentation shows the raw request and response next to every SDK example so you have what you need.

Common cases

• Node, Python, Go, Ruby: a plain POST with your API key and the purchase code.
• Laravel or Symfony: the PHP SDK drops straight in.
• WordPress plugins and themes: the PHP SDK, or WordPress's own HTTP functions if you would rather not ship a dependency.
• Desktop and mobile apps: the same API, but do the check from your own server rather than from the app, so your API key is never inside something a user can open up.

One rule wherever you call it from

Your API key is a secret. It belongs on a server you control, in an environment variable or a config file outside the web root. It does not belong in JavaScript sent to a browser, in a mobile binary, or committed to a repository.

Reference

Endpoints, payloads and responses are in the API documentation.