Every buyer gets a purchase code. Your item can verify it against our API, and doing
so takes an afternoon at most.
What it does and does not do
Being straight with you: no licence check running on somebody else's server can be made
uncrackable. Your code is on their machine.
What it genuinely achieves is worth the afternoon anyway. It keeps honest buyers honest,
it makes casual copying more effort than paying, and it stops one licence quietly becoming
fifty across an agency, which is where sellers lose the most.
The one mistake that hurts your own buyers
Fail closed and you have built a way for your item to break every customer site at once.
Our API has a bad ten minutes and every install goes dark. Your buyers do not know it was
us; they know your item broke their site.
Treat an unreachable API as "carry on", never as "shut down." A definite
negative, where we reply that the licence is invalid, is a real answer. No reply at all is
not an answer and should change nothing.
Give the check your item id
Your publishable key identifies you, not the item, so the same key goes into everything
you sell. That means the check also has to say which of your items is asking. Each
item has an id, on the Licensing panel of its page in your dashboard, and you pass it
alongside the key.
Leave it out and the SDK refuses to activate at all, which is deliberate. If a code only
had to match the seller, someone who bought your twelve dollar item could use that code to
unlock your two hundred dollar one. With the id in place a purchase code only ever works on
the item it was bought for.
Get the id before you zip, not after
The id belongs to the item, so the item has to exist before there is an id to copy. That
catches people out, because the id then has to go inside the zip you upload to that same
item.
The order that works:
- Create the item in your dashboard and save it as a draft. A draft needs only a title,
so this takes a moment.
- Open the Licensing panel on that item and copy the id.
- Paste it into your script alongside your publishable key.
- Zip your script with the id already inside, and upload it to that item.
- Finish the listing and submit for review.
The id never changes, so you paste it once and it keeps working through every version you
release. A different item gets a different id, so do not carry one across when you duplicate
a listing.
Practical rules
- Check on install and occasionally after, never on every page load
- Store the signed token and work from it between checks
- Use a short timeout, so a slow response never hangs a page
- Log failures quietly for yourself rather than showing them to the buyer
- Keep your API key server side, never in the zip you distribute
- Copy the item id from the dashboard; one wrong character locks out every buyer
The PHP SDK already does all of this, which is the main argument for using it rather than
writing your own. The API underneath is plain HTTPS and JSON, so any language works. See the
API documentation.