Verifying a licence from your software
Call one public endpoint to check whether a licence key is valid, with no API key needed and browser requests allowed.
Licence verification is a public endpoint. It needs no API key, which means your application can call it directly, including from a browser — cross-origin requests are allowed by design.
Checking a key
GET /api/verify-license?key=EMBP-7K4M-9XQP-2WRT-H8YNPass an optional product identifier as well if you want to be sure the key belongs to the product your software is checking, rather than to anything you sell.
A valid key returns the product, the licence status, the expiry if there is one, and how many of the permitted activations are used. The buyer's email address is included but masked.
Reading the answer
An invalid key is not an HTTP error. The request succeeds and the body tells you it is not valid, alongside a reason code you can branch on: the key is unknown, it belongs to a different product, it has been revoked or suspended, or it has expired.
This matters when you write the client: check the validity flag in the body, not the HTTP status. A missing key parameter is a genuine 400, and exceeding the limit is a 429.
Activating and deactivating
Two further endpoints record which machines are using a key. Activating sends the key and a machine identifier of your choosing; activating the same machine twice is a no-op rather than an error, so your software can call it on every launch. Deactivating frees the slot for another machine.
Exceeding the activation limit returns a 400 with a machine-readable reason, so present your own message to the user rather than showing the raw code.
Rate limits
| Endpoint | Limit |
|---|---|
| Verify | 30 requests per minute, per IP address |
| Activate and deactivate | 20 requests per minute, per IP address |
Still stuck?
Email support@embpay.com. It is the same address on every plan — there is no priority queue to be prioritised over. If something on this page disagrees with what the product does, that is a bug in this page and we want to hear about it.
Related
- Selling software with licence keysIssue a licence key on purchase, cap how many machines can activate it, optionally expire it, and verify it from your own software.
- API keys and rate limitsCreate an API key on the Scale plan, authenticate with a bearer token, and stay inside 100 requests per minute per key.
- Receiving webhooks and verifying signaturesReceive seven order and subscription events at your own https endpoint, verify the signature, and understand the retry schedule.