License API integration

Connect your plugin

Generating a MCPlugs key does not protect an uploaded JAR automatically. Your plugin must call the licensing API over HTTPS. Never put provider credentials, the encryption key or signing secrets into distributed plugins.

Installation identity

Generate a random UUID on first installation and store it in your plugin’s private configuration. Keep it across restarts. Do not use a changing IP address as identity.

Activate

POST a JSON body to /api/licenses/activate:

{
  "key": "MCP_REPLACE_WITH_CUSTOMER_KEY",
  "productId": "PRODUCT_UUID",
  "installationId": "PERSISTED_INSTALLATION_UUID",
  "label": "Survival server"
}

A successful response contains valid: true, the product and installation identifiers, the key generation, recheckAfterSeconds: 900 and maximumOutageGraceSeconds: 86400. Repeating the same activation does not consume another seat. A 409 means the activation limit is reached.

Validate and deactivate

POST the same key, productId and installationId to /api/licenses/validate every 15 minutes while in use. To release a seat, POST them to /api/licenses/deactivate. Unknown keys, mismatched products, inactive entitlements and unactivated installations receive 403. Rate limits return 429. Do not place raw keys in query parameters or log request bodies.

Outages

For a previously validated installation, cache the last successful validation locally and tolerate a temporary network/server outage for at most 24 hours. Do not grant first-time activation without a successful server response. A definite rejection or revocation is different from a network outage. After the grace period, disable only your own premium functionality and explain recovery steps; never modify or delete worlds, inventories or unrelated files.

Rotation

Customers can rotate a key from their library after signing in recently. This invalidates the old key, clears all activations and increments its generation. Rotation has a 24-hour cooldown and an idempotency identifier. The customer must update every installation.

Limits of client enforcement

A distributed plugin can be modified by its recipient. Runtime checks discourage casual sharing but cannot guarantee tamper resistance. Server-side secrets must stay on MCPlugs.