KDPika Licensing Sign inStart free
API v1
Show all languages
Browse documentation

Choose a page in the navigation drawer.

KDPika Licensing · API v1 Intermediate

Activate an installation

Bind a customer license to one persisted installation.

On this page
Updated 2026-10-17 UTCDownload Markdown

Bind a customer license to one persisted installation.

What you will learn

  • Send this exact operation with its required credentials and fields.
  • Interpret success, refusal, side effects and retry risks.

Prerequisites

Method and path

POST /api/v1/licenses/activate

When to use it

Bind an eligible customer license to the persisted random installation ID of a desktop app, CLI, plugin host or trusted service. Include email if your chosen application flow requires a matching email; this API also supports key-only activation.

Authentication and environment

Use the public X-App-ID and a customer license key. X-Environment defaults to SANDBOX; the license/customer lookup is environment-scoped.

Request headers

HeaderRequiredDescriptionExample
AcceptrecommendedJSON responsesapplication/json
Content-Typefor JSON bodyUse the documented JSON objectapplication/json
X-App-IDyesPublic App ID,8–80 trimmed characters.YOUR_PUBLIC_APP_ID
X-EnvironmentnoActivation environment; backend normalizes case. Does not override token/developer-key bindings.SANDBOX

Path and query parameters

No path parameters are accepted.

No pagination, filtering, sorting or list query parameters are implemented. Use JSON rather than relying on alternate form/query parsing.

Request body

FieldTypeRequiredConstraints/defaultDescriptionExample
license_keystringyesminLength=12; maxLength=100Customer license key; case-insensitive hashed lookup."YOUR_CUSTOMER_LICENSE_KEY"
device_idstringyesminLength=16; maxLength=255Persisted random installation ID."YOUR_PERSISTED_INSTALLATION_ID"
emailstringnomaxLength=190Optional; nonempty normalized email must match the license customer."customer@example.invalid"
device_namestringnomaxLength=160Optional descriptive label; invalid length becomes empty."Example workstation"
platformstringnomaxLength=50Optional description, no OS enum."macOS"
app_versionstringnomaxLength=30Optional version; empty bypasses version-range check."1.0.0"

Full request JSON

jsonjson
{
  "license_key": "YOUR_CUSTOMER_LICENSE_KEY",
  "device_id": "YOUR_PERSISTED_INSTALLATION_ID",
  "email": "customer@example.invalid",
  "device_name": "Example workstation",
  "platform": "macOS",
  "app_version": "1.0.0"
}

The schemas describe supported recommended input types. Current PHP parsing trims/casts strings and may ignore unknown fields; it is not strict JSON-schema validation. Invalid optional descriptive fields can become empty/null. Conventions describes malformed JSON and alternate parsing.

Success response

HTTP 200. The following is a real isolated Sandbox capture; secret values are replaced with explicit placeholders.

jsonjson
{
  "success": true,
  "activation_token": "YOUR_ACTIVATION_TOKEN",
  "license": {
    "payload": {
      "license_id": "lic_578581bd80c2a672da30fc29",
      "product_id": "app_a642cd24641ec976626b",
      "product": "Docs fixture product",
      "plan": "fixture-plan",
      "status": "active",
      "environment": "sandbox",
      "expires_at": "2026-11-16T10:39:35+00:00",
      "license_key_mask": "TESTDOCS-••••-••••-HAHH",
      "starts_at": "2026-10-17T10:39:35+00:00",
      "created_at": "2026-10-17T12:39:35+00:00",
      "max_devices": 2,
      "max_activations": 4,
      "activation_count": 1,
      "min_version": null,
      "max_version": null,
      "active_devices": 1,
      "customer": {
        "id": "cus_d7db5516f8377f89a869e293",
        "name": "Synthetic contract customer",
        "email": "contract-6b9f0843f1d3609f@example.invalid",
        "company": null,
        "country": null
      },
      "product_details": {
        "id": "app_a642cd24641ec976626b",
        "name": "Docs fixture product",
        "platform": "desktop"
      },
      "plan_details": {
        "id": "plan_3bf54c099326639ee183661f",
        "name": "Fixture plan",
        "slug": "fixture-plan",
        "billing_type": "monthly",
        "price": 19.5,
        "currency": "EUR",
        "duration_days": 30,
        "trial_days": null
      },
      "features": {
        "pdf_export": true
      },
      "device": {
        "id": "dev_299a6753c013047b3ed013de",
        "installation_hash": "e119b615ebfb5e5a2da5ea9c2a64b2117621399ff61d16718d460e0bb919a988",
        "name": "Synthetic local installation",
        "platform": "test",
        "app_version": "1.0.0"
      },
      "server_time": "2026-10-17T10:39:35+00:00",
      "next_validation_at": "2026-10-18T10:39:35+00:00",
      "offline_grace_until": "2026-10-24T10:39:35+00:00"
    },
    "signature": "wYwFAPoyaaIVtq8zvUHlQeyqV91sI7115WJHUzY7unDEjOts7MrN_OL3PZAd-Ahd-OdfI-EjIwAVwhfLbYQlDQ",
    "algorithm": "Ed25519",
    "key_id": "ed25519_2b9bc7e214b1209f"
  },
  "request_id": "req_11a6f2cf9cfffdaf92e1a6ce"
}

Response fields

FieldTypeRequiredConstraintsDescriptionExample
successbooleanyesconst=trueThe operation succeeded.true
activation_tokenstringyesSee descriptionact_ plus43 base64url characters; installation secret, do not log."YOUR_ACTIVATION_TOKEN"
licenseobjectyesSee descriptionOnly payload is signed. This is PHP-specific canonical JSON, not RFC8785.Nested object/array shown in full JSON
license.payloadobjectyesSee descriptionExact signed snapshot. Signature authenticity alone does not grant access.Nested object/array shown in full JSON
license.payload.license_idstringyesSee descriptionLicense public identifier."lic_578581bd80c2a672da30fc29"
license.payload.product_idstringyesSee descriptionPublic App ID; compare to configured product."app_a642cd24641ec976626b"
license.payload.productstringyesSee descriptionProduct display name."Docs fixture product"
license.payload.planstringyesSee descriptionProduct-plan slug."fixture-plan"
license.payload.statusstringyesenum=["active", "suspended", "revoked", "expired", "pending", "cancelled"]Stored license status in lowercase."active"
license.payload.environmentstringyesenum="sandbox", "[live"]Bound license environment."sandbox"
license.payload.expires_atstring or nullyesformat="date-time"Independent license expiry; null has no configured expiry."2026-11-16T10:39:35+00:00"
license.payload.license_key_maskstringyesSee descriptionDisplay-only masked key."TESTDOCS-••••-••••-HAHH"
license.payload.starts_atstring or nullyesformat="date-time"Configured license start, currently not enforced by server eligibility."2026-10-17T10:39:35+00:00"
license.payload.created_atstring or nullyesformat="date-time"Creation timestamp; database-timezone discrepancy is disclosed."2026-10-17T12:39:35+00:00"
license.payload.max_devicesintegeryesSee descriptionConcurrent device limit.2
license.payload.max_activationsinteger or nullyesSee descriptionCumulative activation cap; null means no configured cap.4
license.payload.activation_countintegeryesSee descriptionCumulative consumed activations.1
license.payload.min_versionstring or nullyesSee descriptionOptional lower version restriction.null
license.payload.max_versionstring or nullyesSee descriptionOptional upper version restriction.null
license.payload.active_devicesintegeryesSee descriptionActive count at snapshot time.1
license.payload.customerobjectyesSee descriptionCustomer information; personal data, not an authentication credential.Nested object/array shown in full JSON
license.payload.customer.idstringyesSee descriptionCustomer public identifier."cus_d7db5516f8377f89a869e293"
license.payload.customer.namestring or nullyesSee descriptionOptional customer name."Synthetic contract customer"
license.payload.customer.emailstringyesSee descriptionCustomer email associated with this license."contract-6b9f0843f1d3609f@example.invalid"
license.payload.customer.companystring or nullyesSee descriptionOptional company.null
license.payload.customer.countrystring or nullyesSee descriptionOptional country.null
license.payload.product_detailsobjectyesSee descriptionProduct display metadata.Nested object/array shown in full JSON
license.payload.product_details.idstringyesSee descriptionPublic App ID."app_a642cd24641ec976626b"
license.payload.product_details.namestringyesSee descriptionProduct display name."Docs fixture product"
license.payload.product_details.platformstringyesSee descriptionLowercase configured product platform."desktop"
license.payload.plan_detailsobjectyesSee descriptionProduct plan, not the developer platform subscription.Nested object/array shown in full JSON
license.payload.plan_details.idstringyesSee descriptionInternal product-plan identifier."plan_3bf54c099326639ee183661f"
license.payload.plan_details.namestringyesSee descriptionPlan display name."Fixture plan"
license.payload.plan_details.slugstringyesSee descriptionPlan slug."fixture-plan"
license.payload.plan_details.billing_typestringyesSee descriptionLowercase product-plan billing type."monthly"
license.payload.plan_details.pricenumberyesSee descriptionPHP float; preserve numeric tokens such as19.0 for signatures.19.5
license.payload.plan_details.currencystringyesSee descriptionConfigured product-plan currency."EUR"
license.payload.plan_details.duration_daysinteger or nullyesSee descriptionConfigured duration in days.30
license.payload.plan_details.trial_daysinteger or nullyesSee descriptionConfigured trial duration in days.null
license.payload.featuresobject or arrayyesSee descriptionDynamic plan feature JSON values; empty PHP feature array may be[]. Validate types before use.Nested object/array shown in full JSON
license.payload.deviceobjectyesSee descriptionInstallation binding and descriptions.Nested object/array shown in full JSON
license.payload.device.idstringyesSee descriptionDevice public identifier."dev_299a6753c013047b3ed013de"
license.payload.device.installation_hashstring or nullyesSee descriptionSHA256 of supplied installation ID; null if validation header was omitted."e119b615ebfb5e5a2da5ea9c2a64b2117621399ff61d16718d460e0bb919a988"
license.payload.device.namestring or nullyesSee descriptionOptional device label; activation can return an empty string."Synthetic local installation"
license.payload.device.platformstring or nullyesSee descriptionOptional platform description."test"
license.payload.device.app_versionstring or nullyesSee descriptionOptional application version."1.0.0"
license.payload.server_timestringyesformat="date-time"Signed snapshot time in UTC."2026-10-17T10:39:35+00:00"
license.payload.next_validation_atstringyesformat="date-time"server_time plus product interval hours."2026-10-18T10:39:35+00:00"
license.payload.offline_grace_untilstringyesformat="date-time"server_time plus grace hours, not added after the validation interval."2026-10-24T10:39:35+00:00"
license.signaturestringyespattern="^[A-Za-z0-9_-]{86}$"Unpadded base64url Ed25519 signature over canonical payload bytes."wYwFAPoyaaIVtq8zvUHlQeyqV91sI7115WJHUzY7unDEjOts7MrN_OL3PZAd-Ahd-OdfI-EjIwAVwhfLbYQlDQ"
license.algorithmstringyesconst="Ed25519"Fixed algorithm, not negotiated."Ed25519"
license.key_idstringyesSee descriptionMust equal independently trusted key ID."ed25519_2b9bc7e214b1209f"
request_idstringyespattern="^req_[a-f0-9]{24}$"Request correlation ID. Replay bodies can retain an earlier ID."req_11a6f2cf9cfffdaf92e1a6ce"

Response headers

X-Request-ID identifies the current request. Successful limited calls include X-RateLimit-Remaining and X-RateLimit-Reset, the latter in Unix seconds.

Errors omit those rate headers and Retry-After. See the complete rate-limit reference.

Error responses

CodeHTTPCauseFixRetryable?
RATE_LIMITED429Bucket exhausted; wait for window reset; no licensing Retry-After headerAfter window; apply jitterAfter the 60-second window, with jitter
INVALID_REQUEST422Input constraints or entitlement/resource/renewal domain rejectionCorrect input/plan; not blind retryNo blind retry; apply the correction
INVALID_LICENSE404Activation key/product/environment/customer email mismatch; SDK empty key local error has no HTTPCorrect detailsNo blind retry; apply the correction
LICENSE_EXPIRED403Elapsed expires_at before state check; or EXPIRED state; SDK local expiry has no HTTPRenew eligible licenseNo blind retry; apply the correction
LICENSE_REVOKED403License REVOKED and no elapsed deadline taking precedenceDo not retry; contact developerNo blind retry; apply the correction
LICENSE_SUSPENDED403License SUSPENDED and no elapsed deadline taking precedenceRestore then reactivateNo blind retry; apply the correction
LICENSE_CANCELLED403License CANCELLED and no elapsed deadline taking precedenceDo not retry; new eligible licenseNo blind retry; apply the correction
LICENSE_PENDING403License PENDING and no elapsed deadline taking precedenceWait for authorized activationNo blind retry; apply the correction
APP_VERSION_NOT_SUPPORTED403Nonempty activation app_version outside configured rangeUse supported versionNo blind retry; apply the correction
DEVICE_LIMIT_REACHED409New/inactive installation while active seats >= license.max_devicesDeactivate/reset a seatNo blind retry; apply the correction
ACTIVATION_LIMIT_REACHED409New/inactive installation while activation_count >= max_activationsDeveloper adjusts policy; reset-devices does not zero countNo blind retry; apply the correction
INTERNAL_ERROR500Uncaught exception at global boundarySafe retry only for idempotent operation; preserve request_idOnly safe reads after backoff; reconcile mutations

An unregistered path or wrong method is handled by the global router as NOT_FOUND (HTTP 404), not405. Every licensing error has success=false, error.code, error.message and request_id. Errors keeps SDK-local and operational namespaces separate.

Side effects

Creates/reactivates a device and creates a new activation token. A new or inactive device consumes activation_count and an active seat. Reusing an already ACTIVE device keeps the seat/count but revokes its earlier active tokens and issues a replacement token. Concurrent device checks and updates use a license transaction and row locks. Audit and webhook license.activated are emitted; no email is sent directly. Device limits belong to the license, not the displayed platform-wide device allowance.

Authenticated requests can consume the organization monthly API usage counter once tenant context is established, including some failures. This usage counter is currently warning-only, not a monthly API rejection gate. Developer-key authentication can update last_used_at before a later failure. No request body or Authorization value is saved by the API metadata logger.

Idempotency and concurrency

Idempotency-Key is ignored. Repeating activation can rotate the token even when the device is unchanged. Save only the latest accepted token through your secure-storage flow. Do not run simultaneous activation requests for one installation; their responses can arrive out of order and leave one caller holding an already-revoked token.

Rate limits

20 requests per60 seconds for SHA256(IP + Public App ID + supplied trimmed license-key text). Early invalid input can reject before this bucket is reached. This is not an organization-wide abuse quota.

Fixed windows begin with the first hit after expiry. Attempted calls consume every bucket they reach, even if later business validation fails.

Runnable examples

These are complete native HTTP transport programs, not full SDK clients or entitlement verifiers. JSON request bodies and credentials come from KDP_* environment variables. They print raw responses to a private terminal; do not send their stdout to application/CI logs. Use the P5 verification guides before granting access.

Java

Save every file shown below. Install the exact runtime/dependencies from the complete example archive README. Set the endpoint request JSON in KDP_BODY_JSON and the documented KDP_* credential variables in your private process environment.

Run java -cp .:gson.jar Request activate. Expected: full JSON, exit 0 for success, exit 1 for an API rejection; exit 2 for setup/transport failure. The cURL sample checks HTTP status; parse JSON before use. Never authorize a feature from transport output alone.

Request.javajava
// Purpose: inspect one client-callable Sandbox operation, not grant feature access.
// Requires Java17+, Gson2.14.0. Run: java -cp .:gson.jar Request public-key
// Windows classpaths use semicolons. Expected: JSON; exit0 success/1 API error/2 setup or transport.
// Credentials/body: KDP_* environment variables. Private terminal only; output may contain secrets.
import java.net.URI;
import java.net.http.*;
import java.nio.charset.StandardCharsets;
import java.time.Duration;
import com.google.gson.*;

public final class Request {
    static final String CONTRACT = """
{
  "public-key": {
    "method": "GET",
    "path": "/public-key",
    "auth": "public"
  },
  "activate": {
    "method": "POST",
    "path": "/licenses/activate",
    "auth": "publicApp"
  },
  "validate": {
    "method": "POST",
    "path": "/licenses/validate",
    "auth": "activation"
  },
  "deactivate": {
    "method": "POST",
    "path": "/licenses/deactivate",
    "auth": "activation"
  }
}
""";
    static String required(String name) {
        String value = System.getenv(name);
        if (value == null || value.isEmpty() || value.contains("\r") || value.contains("\n")) throw new IllegalArgumentException("Missing configuration.");
        return value;
    }
    public static void main(String[] args) {
        try {
            JsonObject operations = JsonParser.parseString(CONTRACT).getAsJsonObject();
            if (args.length != 1 || !operations.has(args[0])) throw new IllegalArgumentException("Unknown operation.");
            String name = args[0]; JsonObject op = operations.getAsJsonObject(name);
            String base = System.getenv().getOrDefault("KDP_BASE_URL", "https://licensing.kdpika.com/api/v1").replaceAll("/+$", "");
            URI uri = URI.create(base);
            boolean local = "http".equals(uri.getScheme()) && ("localhost".equals(uri.getHost()) || "127.0.0.1".equals(uri.getHost())) && "1".equals(System.getenv("KDP_ALLOW_LOOPBACK"));
            if (uri.getHost() == null || (!"https".equals(uri.getScheme()) && !local) || uri.getUserInfo() != null || uri.getQuery() != null || uri.getFragment() != null || !"/api/v1".equals(uri.getPath())) throw new IllegalArgumentException("Invalid base URL.");
            HttpRequest.Builder request = HttpRequest.newBuilder(URI.create(base + op.get("path").getAsString())).timeout(Duration.ofSeconds(15))
                .header("Accept", "application/json").header("User-Agent", "KDPikaDocsExample/1.0 Java");
            String auth = op.get("auth").getAsString();
            if (auth.equals("publicApp")) request.header("X-App-ID", required("KDP_APP_ID")).header("X-Environment", "SANDBOX");
            if (auth.equals("activation")) request.header("Authorization", "Bearer " + required("KDP_ACTIVATION_TOKEN"));
            if (name.equals("validate")) request.header("X-Installation-ID", required("KDP_INSTALLATION_ID"));
            if (op.get("method").getAsString().equals("POST")) {
                String body = System.getenv().getOrDefault("KDP_BODY_JSON", "{}");
                if (!JsonParser.parseString(body).isJsonObject()) throw new IllegalArgumentException("JSON object required.");
                request.header("Content-Type", "application/json").POST(HttpRequest.BodyPublishers.ofString(body, StandardCharsets.UTF_8));
            } else request.GET();
            HttpClient client = HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(5)).followRedirects(HttpClient.Redirect.NEVER).build();
            HttpResponse<String> response = client.send(request.build(), HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
            JsonObject result = JsonParser.parseString(response.body()).getAsJsonObject();
            System.out.write(response.body().getBytes(StandardCharsets.UTF_8)); System.out.write(10);
            if (response.statusCode() < 200 || response.statusCode() >= 300 || !result.has("success") || !result.get("success").equals(new JsonPrimitive(true))) {
                System.err.println("API rejection. Inspect error.code/request_id; reconcile mutations before retrying."); System.exit(1);
            }
        } catch (Exception error) {
            System.err.println("Request unavailable or configuration invalid. Check KDP_* settings/connectivity; do not blindly retry mutations."); System.exit(2);
        }
    }
}

Expected result

A correctly authenticated eligible request returns the documented HTTP status and schema. Check the actual success/error result and request IDs; a successful transport or unsigned management response does not grant a feature.

Common mistakes

  • Mixing Public App IDs, internal product IDs and product-plan IDs.
  • Assuming a mutation timeout means no work committed, or assuming Idempotency-Key protects every action.
  • Logging raw responses that contain a newly issued license key or activation token.

Security notes

Keep lmp_ credentials out of shipped desktop/browser code. Verify signed payload bytes and product/environment/installation/status/time/feature policy. The examples do not fix the documented idempotency, cache canonicalization or current-key-only rotation limitations.

Troubleshooting

SymptomCauseAction
RATE_LIMITED (HTTP 429)Bucket exhausted; wait for window reset; no licensing Retry-After headerAfter window; apply jitter
INVALID_REQUEST (HTTP 422)Input constraints or entitlement/resource/renewal domain rejectionCorrect input/plan; not blind retry
INVALID_LICENSE (HTTP 404)Activation key/product/environment/customer email mismatch; SDK empty key local error has no HTTPCorrect details
LICENSE_EXPIRED (HTTP 403)Elapsed expires_at before state check; or EXPIRED state; SDK local expiry has no HTTPRenew eligible license
LICENSE_REVOKED (HTTP 403)License REVOKED and no elapsed deadline taking precedenceDo not retry; contact developer
LICENSE_SUSPENDED (HTTP 403)License SUSPENDED and no elapsed deadline taking precedenceRestore then reactivate
LICENSE_CANCELLED (HTTP 403)License CANCELLED and no elapsed deadline taking precedenceDo not retry; new eligible license
LICENSE_PENDING (HTTP 403)License PENDING and no elapsed deadline taking precedenceWait for authorized activation
APP_VERSION_NOT_SUPPORTED (HTTP 403)Nonempty activation app_version outside configured rangeUse supported version
DEVICE_LIMIT_REACHED (HTTP 409)New/inactive installation while active seats >= license.max_devicesDeactivate/reset a seat
ACTIVATION_LIMIT_REACHED (HTTP 409)New/inactive installation while activation_count >= max_activationsDeveloper adjusts policy; reset-devices does not zero count
INTERNAL_ERROR (HTTP 500)Uncaught exception at global boundarySafe retry only for idempotent operation; preserve request_id

Next steps

Read idempotency and signed responses before integrating a purchase-to-license workflow.

Was this page helpful?

Choose an answer

Do not include personal data, license keys or credentials. Retained for up to 30 days. This is not a support inbox.

Search documentation

Arrow keys to move, Enter to open, Escape to close. Search stays in your browser.

Cookie settings