Automation API

Create, look up, revoke and reset license keys from scripts, checkout webhooks and bots — without ever sharing your password.

API tokens

In your dashboard open Settings → API tokens → New token. Give it a name, tick only the permissions it needs, optionally limit it to your server’s IP addresses and an expiry, and confirm with your password. The token is shown once; only a hash is stored, so a lost token can’t be recovered — revoke it and create another.

Permission	Allows
`products:read`	`GET /products`
`keys:create`	`POST /keys` — up to 100 keys per call; optional `keyType` and `maxDevices`
`keys:read`	`GET /keys/:key` — status, expiry, whether it is bound, customer e-mail and notes
`keys:revoke`	`POST /keys/:key/revoke` and `/restore`
`keys:reset`	`POST /keys/:key/reset-device` (device-locked keys; a public key has no device)

A token can only ever reach your own products and keys. It cannot touch your account settings, other tokens, billing or anyone else’s data — and it stops working immediately if its owner account is suspended.

Create keys from a checkout webhook

curl -X POST https://license.foliox.sbs/api/automation/v1/keys \
  -H "Authorization: Bearer $LICENSE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"product":"YOUR_PRODUCT_ID","count":1,"durationDays":365,"customerEmail":"[email protected]"}'

# → 201 { "keys": [ { "key": "TVMWF-…", "status": "unused", "duration_days": 365, "key_type": "device", … } ] }

If you pass customerEmail, the customer is e-mailed the key (and later the expiry reminders) automatically, exactly as if you had created it in the dashboard.

Public keys

Add "keyType": "public" to create keys with no device binding: any number of people can use the same key at the same time. Leave it out (or send "device") for the usual keys that lock to one device. Every key in a response carries its key_type.

curl -X POST https://license.foliox.sbs/api/automation/v1/keys \
  -H "Authorization: Bearer $LICENSE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"product":"YOUR_PRODUCT_ID","keyType":"public","durationDays":30}'

Look up and manage a key

GET  /api/automation/v1/keys/TVMWF-WFPKW-7AWNP-C5RE5-Z              # keys:read
POST /api/automation/v1/keys/…/revoke                                # keys:revoke
POST /api/automation/v1/keys/…/restore                               # keys:revoke
POST /api/automation/v1/keys/…/reset-device                          # keys:reset

Errors

Status / code	Meaning
`401 INVALID_TOKEN`	Missing, wrong, expired, revoked, or used from an address the token isn’t allowed from.
`403 INSUFFICIENT_SCOPE`	The token lacks the permission for that call.
`403 ACCOUNT_SUSPENDED`	The account that owns the token is suspended.
`402 PLAN_LIMIT`	Creating that would exceed your plan’s key limit. The body names the limit.
`404`	No such product or key in your account.
`409 PUBLIC_KEY`	A device reset was asked for a public key, which is never bound to a device.
`400`	Invalid input; `error.fields` says which field.
`429`	Too many requests (300 per minute per address; 30 failed attempts per 15 minutes).

Good practice

One token per integration, with the smallest set of permissions, so you can revoke one without disturbing the others.
Pin it to your server’s IP address and give it an expiry you will remember to renew.
Keep it in an environment variable or secret store — never in client-side code or a repository.