License key API for activation and verification

The client API

Your app talks to two endpoints. Both always return HTTP 200 for a request the server understood — the outcome is in the signed body, so ordinary HTTP clients never need exception handling to read “expired”.

POST https://license.foliox.sbs/api/v1/activate
{ "product": "my-tool", "key": "TVMWF-WFPKW-7AWNP-C5RE5-Z", "hwid": "<sha256 of machine id>" }

POST https://license.foliox.sbs/api/v1/verify      (same body)

The reply is { "payload": { "valid": true, "reason": null, "expires_at": "…", "offline_grace_until": "…" }, "signature": "…" }, signed with Ed25519. Verify the signature with the public key from /api/v1/public-key and you know the answer came from us.

The automation API

Create a scoped API token in your dashboard — for instance “create keys” only, limited to your server’s IP — and call it from your checkout webhook:

curl -X POST https://license.foliox.sbs/api/automation/v1/keys \
  -H "Authorization: Bearer lk_…" -H "Content-Type: application/json" \
  -d '{"product":"my-tool","count":1,"durationDays":365,"customerEmail":"[email protected]"}'

Other scopes let a script look up, revoke, restore or reset keys. A token can never touch your account settings or anyone else’s data.

Designed for real apps

• Offline grace: each answer includes a 72-hour grace time; SDKs cache the last signed “valid” reply.
• Clear reasons: expired, revoked, hwid_mismatch, not_activated, suspended, blocked…
• Rate limits per address and per key protect both you and the service.

Full details are in the API reference.