The API, if you would rather call it yourself

1.The API, if you would rather call it yourself

The library is a thin wrapper over one endpoint. Call it directly if you work outside PHP — but then you must implement the caching rules above yourself, and verify the signature.

Endpoint

POST https://addonsmarket.com/api/license

Request

HTTP

POST /api/licence HTTP/1.1
Host: addonsmarket.com
Content-Type: application/json
User-Agent: MonProduit/1.0

{
  "cle": "VOTRE_CLE",
  "url": "boutique.exemple.fr"
}

What you send

cle	string	The buyer’s key. Letters and digits only; we strip anything else, so pasted spaces and dashes are harmless.
url	string	The host your product runs on. A full URL works too — we keep only the host. Strip the port and the leading www. yourself if you want the response to match what you sent.

Response

JSON

{
  "donnees": {
    "ok": true,
    "motif": "",
    "domaine": "exemple.fr",
    "essai": false,
    "quand": "",
    "emis": 1790687453,
    "revalider": 1790773853,
    "sursis": 2592000,
    "hote": "boutique.exemple.fr"
  },
  "signature": "4p9JXJRfcB5R/LNEQwr/cwnVv1M5R1OdCNcU…"
}

Response fields

ok	bool	Whether the product may run here.
motif	string	Why not, when ok is false. See the table below.
domaine	string	The domain the licence is bound to.
essai	bool	Development key or staging domain.
quand	string	When the key was replaced or revoked.
emis	int	When we answered. The start of the 30-day grace period.
revalider	int	Timestamp before which you must not ask again.
sursis	int	Seconds you may keep this verdict if we stop answering.
hote	string	The host we answered about. Reject the response if it is not yours.

HTTP statuses

200	A signed verdict. Note that a refusal is also a 200 — read ok, not the status code.
400	Missing key or missing host.
405	Anything other than POST or OPTIONS.
429	Rate limit reached. Keep your cached verdict and retry later — never treat this as a refusal.

Thirty calls a minute per IP address. With the caching rules respected, a shop makes one call a day, so you will only meet this limit from a load test or a loop that forgot its cache.

Send a User-Agent that names your product. A few default agents of HTTP libraries — Python’s urllib among them — are filtered before they reach us and get a 403. Any custom string avoids it.

Something unclear?

Write to us from your author area. A question that needed asking usually means this page is missing a paragraph.

Author area