Activate License

Registers a site URL to a license key and returns an HMAC secret for subsequent authenticated requests.

POST/api/activate-license

This is the bootstrap endpoint. It is an unauthenticated request used once per installation to "link" a WordPress site to a license.

Request Body

{
  "license_key": "XXXX-XXXX-XXXX-XXXX",
  "site_url": "https://example.com"
}

Successful Response (200 OK)

{
  "site_registration": {
    "registered": true,
    "site_secret": "h_64_character_hmac_secret_here..."
  },
  "license_info": {
    "plan": "professional",
    "expires_at": "2025-12-31T23:59:59Z"
  },
  "message": "License is valid. Site is registered."
}

Rate Limiting

To prevent abuse, this endpoint is limited to 20 requests per minute per IP address. If exceeded, the API will return a 429 Too Many Requests response.

Important Notes

The site_secret returned is essential. It must be stored securely on the WordPress site as it is required to sign all future requests.
A single license key can activate multiple sites depending on the plan limits.
If the activation limit for the plan is reached, a 403 Forbidden error is returned.