Public Endpoints
The License Server exposes a public REST API for client plugins and themes to manage activations and check for updates.
Base Namespace:
/wp-json/license-server/v11. License Activation (POST /activate)
Section titled “1. License Activation (POST /activate)”Registers a specific domain or environment against a license key.
Request Body (JSON)
Section titled “Request Body (JSON)”| Field | Type | Required | Description |
|---|---|---|---|
license_key | string | Yes | The license key provided to the customer. |
slug | string | Yes | The software slug (e.g., my-cool-plugin). |
domain | string | Yes | The normalized host name of the client site. |
Example Request
Section titled “Example Request”{ "license_key": "WPAB-6638C488-ABCD", "slug": "my-cool-plugin", "domain": "example.com"}Success Response (200 OK)
Section titled “Success Response (200 OK)”{ "success": true, "message": "License activated successfully.", "license": "valid", "expires_at": "2025-12-31 23:59:59"}Error Responses
Section titled “Error Responses”- 400 Bad Request: Missing required parameters or slug mismatch.
- 403 Forbidden: Activation limit reached or license inactive/expired.
- 404 Not Found: Invalid license key.
2. License Status Check (GET /check)
Section titled “2. License Status Check (GET /check)”Verifies the current status of a license.
Query Parameters
Section titled “Query Parameters”| Parameter | Type | Required | Description |
|---|---|---|---|
license_key | string | Yes | The license key to check. |
slug | string | Yes | The software slug. |
domain | string | No | If provided, also verifies if the license is active for this domain. |
Success Response (200 OK)
Section titled “Success Response (200 OK)”{ "success": true, "license": "valid", "expires_at": "2025-12-31 23:59:59", "activation_limit": 3}3. Update Check (GET /update-check/{slug}/{license_key})
Section titled “3. Update Check (GET /update-check/{slug}/{license_key})”Returns metadata in a format compatible with the WordPress.org Plugin API and the Plugin Update Checker (PUC) library.
Parameters
Section titled “Parameters”{slug}: The software slug.{license_key}: The customer’s license key.
Optional Query Params
Section titled “Optional Query Params”host: The host URL requesting the update (for logging).
Success Response (200 OK)
Section titled “Success Response (200 OK)”{ "name": "My Cool Plugin Pro", "slug": "my-cool-plugin", "version": "2.1.0", "download_url": "https://server.com/wp-json/license-server/v1/download/my-cool-plugin/WPAB-...", "package": "https://server.com/wp-json/license-server/v1/download/my-cool-plugin/WPAB-...", "homepage": "https://server.com", "requires": "5.0", "tested": "6.5", "sections": { "description": "Full plugin description...", "changelog": "<h4>2.1.0</h4><ul><li>Bug fixes...</li></ul>" }}4. Protected Download (GET /download/{slug}/{license_key})
Section titled “4. Protected Download (GET /download/{slug}/{license_key})”Streams the latest release zip file. This endpoint performs full license validation before initiating the stream.
Parameters
Section titled “Parameters”{slug}: The software slug.{license_key}: The customer’s license key.
Headers
Section titled “Headers”The response is returned with standard file-stream headers:
Content-Type: application/zipContent-Disposition: attachment; filename="slug-version.zip"
Rate Limits
Section titled “Rate Limits”To prevent abuse, the following limits are enforced per IP address:
| Endpoint | Limit | Window |
|---|---|---|
/activate | 10 requests | 60 seconds |
/check | 60 requests | 60 seconds |
/update-check | 60 requests | 60 seconds |
/download | 60 requests | 60 seconds |