KDPika Licensing
Sign inStart freeRun a real serial Sandbox lifecycle using your preferred API client; the sequence ends by revoking its test license.
What you will learn
- Import all three native formats and configure test-only variables.
- Understand mutation order, local variables and credential precautions.
Prerequisites
- Read API conventions.
- Complete the Sandbox quickstart.
Downloads
- Postman 2.1 collection
- Postman Sandbox environment with placeholders
- Insomnia legacy-v4 JSON export
- Bruno collection ZIP
Every collection is generated from the same11-operation route/auth/body model as the OpenAPI and endpoint pages. All exported credential values are obvious placeholders. The exports are files on KDPika hosting; no external API-client cloud service is needed by the platform itself.
Important: this sequence changes test data
Run serially in Sandbox: public key, create, activate, validate, get, deactivate, suspend, restore, renew, reset-devices and revoke. It creates a test customer/license, consumes an activation, extends expiry by 30 days and finally revokes that license. It does not make a payment or change a developer subscription.
Do not run the full sequence on an existing customer license or in parallel. Do not automatically repeat an uncertain create/renew after a timeout/500. Use a new business-event identity only for an intentionally new test lifecycle, not to conceal an uncertain previous result.
The collections set license_id/license_key after creation and activation_token after a successful Sandbox activation in temporary local/run variables. Read your client version documentation on variable lifetime, histories, cloud sync and reporters. Client applications can persist requests/responses independently of these scripts; this is different from the in-memory website console. Never export populated secrets or share raw response histories.
Configure variables
| Variable | Set it to |
|---|---|
| base_url | https://licensing.kdpika.com/api/v1 |
| app_id | Your Sandbox product public App ID |
| api_key | Sandbox developer key with licenses:read,licenses:write,devices:write |
| product_id | Internal product ID or its scoped slug |
| plan_id | Active product-plan ID or scoped slug |
| customer_email | A synthetic test address, not a real buyer |
| installation_id | One stable random test installation ID,16–255 characters |
| idempotency_key | One unique intentional test-event ID,8–190 characters |
| license_id/license_key/activation_token | Runtime results saved by the sequence; start with placeholders |
| allow_loopback | Leave 0 for hosting;1 only for an explicit local fixture |
Guards require an HTTPS /api/v1 base, or an explicitly opted-in localhost/127.0.0.1:port test base. Management requests require a Sandbox developer-key prefix; activation always sends X-Environment:SANDBOX and requires a TEST-prefixed license. Do not replace guards to force a Live run. Redirects are disabled in the provided requests; certificate verification remains enabled.
Postman
- Import the collection JSON and placeholder environment. Expected:11 requests in the documented order.
- Set private/local Sandbox variable values, without publishing or syncing credentials. Expected: the create request can authenticate with only the required scopes.
- Run the collection once serially. Expected:35 successful assertions, including 201 for create, success/request IDs and Sandbox validation fields.
The v2.1 export is tested with Newman 6.2.3 as a local compatibility engine. Newman is now unmaintained and is not recommended as a new production dependency. Postman v12 Native Git uses the newer v3 format; this download is the explicit2.1 JSON import format, not a v3 Native Git project. Use a maintained Postman client/CLI for your ongoing workflow and check its supported import format.
Postman format/runtime guidance explains that distinction.
Insomnia
- Import the legacy-v4 JSON export using From File. Expected: a Sandbox workspace/environment and11 ordered requests; modern Insomnia retains v4 import compatibility.
- Set the private Sandbox environment values. Expected: no Live key is used.
- Run the collection serially. Expected:35 response tests, including correct201 handling and generated temporary license/token variables.
The actual import/execution is tested with checksum-verified Inso CLI 13.3.1, not claimed as a desktop GUI import test. The CLI run uses the exported file, disables prompts and retains only sanitized status/assertion evidence. Insomnia import formats and collection runner options document the supported file workflow.
This export targets the Liquid template engine in Insomnia13.3.1. Its URL-render guard is independent of pre-request scripts: a refused key/base renders a non-network kdpika-blocked URI. The tested CLI import did not apply the pre-request script, so relying only on a thrown script error or skip flag would not be safe. The actual native negative tests prove that the delivered guard sends no HTTP request for Live keys/licenses or unapproved HTTP. Use the tested client version; older template engines are not claimed compatible. Pinned Insomnia template engine source identifies Liquid.
Bruno
- Extract the ZIP into a local directory and open that collection. Expected: bruno.json, Sandbox environment and11 .bru requests.
- Put credentials in your private local secret/environment setup, not a committed shared file. Expected: placeholder exports remain secret-free.
- Select Sandbox and run serially with the safe scripting sandbox. Expected: all 11 real requests and35 tests pass.
The export is executed with Bruno CLI 4.2.1 using its safe sandbox. Runtime variables use bru.setVar rather than persisting generated tokens into the shared environment export. Bruno scripting API describes its environment/runtime distinction.
What the assertions do not prove
The collection assertions check HTTP status, success/request IDs and selected Sandbox fields. Full nested schema checks run in the contract tests. An assertion pass is not Ed25519 verification, offline licensing, exactly-once fulfillment or a real payment test.
Expected result
Your chosen client imports the actual native files and completes a serial test lifecycle without a Live key or real payment.
Common mistakes
- Running renew/revoke repeatedly against a license you want to keep.
- Confusing temporary script variables with a guarantee that the API client never saves history.
- Disabling TLS/redirect guards to get past a configuration problem.
Security notes
Never share populated environments, raw collection reports or response histories. Use a temporary test workspace and synthetic customer details. Keep all device credentials private.
Troubleshooting
| Symptom | Cause | Action |
|---|---|---|
| Pre-request guard rejects key/base | Wrong scope/environment, placeholder or URL | Set the actual Sandbox values and exact /api/v1 base |
| Later requests use placeholders | Collection was not run serially from creation | Start a deliberate fresh lifecycle; inspect safe status tests |
| 201 counted as failure by a client option | Option expects only200 | Use the supplied per-operation assertions; create legitimately returns 201 |
Next steps
Review the endpoint reference and signature verification.