Account API

The Account API (also called the management API) lets sellers and organizations automate everything they can do in the dashboard. Create products, issue licenses, manage access rules, review license requests, and read billing data — all with scoped API keys.

The Account API is a paid plan feature gated by the API access permission on your seller plan.

Base URL

https://pingless-license-system.vercel.app/api/v1/management

If you are self-hosting, replace https://pingless-license-system.vercel.app with your own deployment URL.

Authentication

Every request must include an API key in the Authorization header:

Authorization: Bearer altis_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Create, regenerate, and revoke keys from Dashboard → Settings → API Keys. The plaintext token is shown only once; the server stores only its SHA-256 hash. Tokens are scoped to your organization and your user account, so a key can never access another organization's data.

Scopes

Each key can be granted one or more scopes. full_access grants every permission, and any :write scope automatically implies the matching :read scope.

Rate limits

Every key has its own per-minute rate limit. The default is 60 requests per minute and can be raised or lowered per key from the API Keys page. Requests that exceed the limit return 429 Too Many Requests with a Retry-After header.

Conventions

• All bodies and responses are JSON.
• List endpoints support limit (max 100), offset, and relevant filters via query params.
• Successful single-resource responses wrap the resource in { data: ... }.
• Successful list responses wrap the array in { data: [], pagination: { limit, offset, total } }.
• Error responses use { error: { code, message } }.
• All operations are scoped to the organization linked to the API key.
• :id path parameters are UUIDs.

Endpoints

Products

POST /products accepts the same fields as the dashboard product form: name, slug, description, product_link, docs_link, support_link, icon_url, is_active, product_type (native or web), protection_profile (none, hostname, or hardware), default_max_activations, default_block_all_until_whitelisted, default_offline_days, and allow_self_regenerate.

Sub-products

Sub-product bodies accept name, slug, description, and is_active.

Feature-flag presets

Preset bodies accept name and flags (an object mapping flag names to string, number, boolean, or null values).

Licenses

POST /licenses accepts:

PATCH /licenses/:id accepts the same fields except product_id. status can be set to active, suspended, or revoked.

License requests

The approve body accepts max_activations, expires_at, offline_days, and feature_flags.

Access rules

Access-rule bodies accept:

Analytics

Response shape:

{
  "summary": {
    "total_checks": 1523,
    "valid_checks": 1489,
    "denied_checks": 34,
    "activation_count": 42
  },
  "top_denial_reasons": [
    { "reason": "denied_seat_limit", "count": 20 }
  ],
  "timeseries": [
    {
      "bucket": "2026-07-15",
      "total_checks": 120,
      "valid_checks": 118,
      "denied_checks": 2,
      "activations": 5
    }
  ]
}

Billing

Plan-change and plan-cancel bodies accept an optional reason string. These endpoints write an audit log request; actual billing changes may still require admin review depending on your integration.

Payment-method bodies accept:

Billing write endpoints require the API key user to be an organization owner or admin.

Example: create a license

curl -X POST https://pingless-license-system.vercel.app/api/v1/management/licenses \
  -H "Authorization: Bearer altis_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "product_id": "550e8400-e29b-41d4-a716-446655440000",
    "user_id": "660e8400-e29b-41d4-a716-446655440001",
    "max_activations": 2,
    "expires_at": "2027-01-01T00:00:00Z",
    "feature_flags": { "tier": "pro", "api_access": true }
  }'

Product public keys

Each product has its own Ed25519 key pair. The public key is available in:

• The ed25519_public_key field of any product response from the Account API.
• The product details page in the dashboard (Ed25519 public key card).

Use this key — not a platform-wide key — to verify /api/v1/license/check signatures.

Rotating a product key

Admins and product owners can rotate the key from the product details page. Rotation increments an internal counter and derives a fresh deterministic key pair from the same master seed. Rotating invalidates every previously signed offline token — clients must update their embedded public key before they can verify new responses.

Verifying webhook signatures

If you configure product webhooks and set a secret, every delivery is signed with HMAC-SHA256 and sent in the X-Webhook-Signature header as sha256=<hex>.

Verify the signature before trusting the payload:

import { createHmac } from "crypto";

function verifyWebhook(secret: string, body: string, signature: string): boolean {
  const expected = "sha256=" + createHmac("sha256", secret).update(body).digest("hex");
  try {
    return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
  } catch {
    return false;
  }
}

Webhook bodies are JSON objects with event, timestamp, and payload keys. Reject any request where the signature does not match.

Error codes

For rate_limit_exceeded responses, the Retry-After header indicates how many seconds to wait before retrying.