The /public/* surface the SDK and plugin installs call to validate licenses and report usage.

The Public API is the surface plugin installs talk to. It authenticates by license key (plus the publishable key shipped in your plugin) — never a user session. The SDK wraps these endpoints; this page documents the raw HTTP.

Base path: /public. All endpoints are POST with a JSON body. The surface is rate-limited independently of the customer portal API.

`POST /public/validate`

Validate a license and activate this device if it isn't already.

// Request
{
  "licenseKey": "LK-2025-XXXX-YYYY",
  "fingerprint": "abc123...",
  "domain": "acmecorp.com"
}

The response reports allowed, the license status, the plan entitlements, and current usage — everything needed to gate your plugin in one call.

`POST /public/entitlements`

Read limits and current usage without performing a full validation.

// Request
{ "licenseKey": "LK-2025-XXXX-YYYY", "fingerprint": "abc123...", "metric": "api_requests" }

// Response (shape)
{
  limits: { apiRequestsPerMonth: number | null, activations: number | null },
  usage:  { used: number, remaining: number, period: string, resetAt: string }
}

`POST /public/usage`

Report metered usage after a chargeable operation.

// Request
{
  "licenseKey": "LK-2025-XXXX-YYYY",
  "metric": "api_requests",
  "quantity": 1,
  "consumeCredits": true
}

The response includes allowed, remaining, and resetAt. Report before doing expensive work so you never perform an unbillable operation.

`POST /public/deactivate`

Free an activation slot for this install.

// Request
{ "licenseKey": "LK-2025-XXXX-YYYY", "fingerprint": "abc123..." }

Authentication & limits

Aspect	Detail
Identity	The license key authenticates the request; no session cookie
Publishable key	Your plugin ships `PLUGIN_PUBLIC_API_KEY`, scoping calls to your deployment
Rate limits	Tuned via `PUBLIC_RATE_LIMIT_WINDOW_MS` / `PUBLIC_RATE_LIMIT_MAX`

Prefer the SDK

The SDK adds typed results, local caching, and an offline fallback on top of these endpoints. Reach for raw HTTP only where you can't run the SDK (e.g. PHP/WordPress) — see the Framework Recipes.

Explore interactively

The full, always-current API — including the portal and connector surfaces — is available as an interactive reference at /api/docs on your API deployment, with the raw spec at /api/openapi.json.

Public API

POST /public/validate

POST /public/entitlements

POST /public/usage

POST /public/deactivate