WordPress license validation is the foundation of any software licensing system. Your customers need to prove they own a valid license before accessing your software, and you need to verify that proof quickly and securely. In this guide, we’ll explore how DMSI DDLS handles WordPress license validation through its REST API.
Why WordPress license validation matters
WordPress license validation is what separates a paying customer from a shared download link. Every time your plugin or theme starts up, it asks a server one question: is this licence still valid for this site? Get that check right and piracy becomes an inconvenience rather than a business model. Get it wrong — or skip it — and every sale you make can be installed anywhere, forever.
Good WordPress license validation has to be three things at once: fast, because it runs on your customer’s site; secure, because the response decides whether your software runs; and forgiving, because a customer whose internet drops should not lose access to software they paid for. The rest of this guide shows how DMSI DDLS handles WordPress license validation against each of those three requirements.
Understanding WordPress License Validation
License validation answers a simple question: “Is this license valid for this installation?”
But behind that simple question are multiple verification steps:
- Does the license key exist in the database?
- Is the license currently active (not expired, suspended, or cancelled)?
- Is this installation authorized to use this license?
- Has the license exceeded its activation limit?
DMSI DDLS handles all of these checks automatically through its validation endpoint.
The Validation Endpoint
The license validation API endpoint is:
POST /wp-json/dmsilm/v1/licenses/validate
This is a public endpoint – it doesn’t require authentication, making it perfect for validating licenses from client software.
Basic Validation Request
Here’s a minimal validation request:
{
"license_key": "XXXX-XXXX-XXXX-XXXX",
"product_id": 123
}
The API returns comprehensive information about the license status.
Site-Specific Validation
Most software needs to restrict licenses to specific installations. Include the site URL in your request:
{
"license_key": "XXXX-XXXX-XXXX-XXXX",
"product_id": 123,
"site_url": "https://customer-site.com"
}
When you include a site URL, DMSI DDLS checks if this site is already activated for the license and includes activation status in the response.
Authentication Methods
While the validation endpoint is public, other API endpoints require authentication. DMSI DDLS supports three authentication methods:
1. Cookie Authentication
For requests from logged-in WordPress users (like from the admin area), no additional authentication is needed. WordPress cookies handle it automatically.
2. Application Passwords
WordPress 5.6+ includes built-in application passwords. Use HTTP Basic Authentication:
curl -u "username:application_password" \
https://example.com/wp-json/dmsilm/v1/licenses
3. API Keys
DMSI DDLS provides its own API key system. Include the key in the X-API-Key header:
curl -H "X-API-Key: dmsi_your_key_here" \
https://example.com/wp-json/dmsilm/v1/licenses
Or as a query parameter:
curl https://example.com/wp-json/dmsilm/v1/licenses?api_key=dmsi_your_key_here
API keys can be generated in the DMSI DDLS admin interface with configurable permissions.
License Activation Management
Beyond validation, the API supports explicit activation management:
Activate a License
POST /wp-json/dmsilm/v1/licenses/{id}/activate
This is also a public endpoint. Request body:
{
"license_key": "XXXX-XXXX-XXXX-XXXX",
"site_url": "https://customer-site.com",
"site_name": "Production Server"
}
Deactivate a License
DELETE /wp-json/dmsilm/v1/licenses/{id}/activations/{activation_id}
Also public. This allows customers to move licenses between installations without contacting support.
Check-In
POST /wp-json/dmsilm/v1/activations/check-in
Periodic check-ins help track active installations:
{
"license_key": "XXXX-XXXX-XXXX-XXXX",
"site_url": "https://customer-site.com"
}
Verify Activation
POST /wp-json/dmsilm/v1/activations/verify
Verify that a specific activation is still valid:
{
"license_key": "XXXX-XXXX-XXXX-XXXX",
"site_url": "https://customer-site.com"
}
Rate Limiting
The validation endpoint includes built-in rate limiting to prevent abuse:
- Unauthenticated requests: 60 requests per hour
- Cookie/Application Password: 120 requests per hour
- API Key: 300 requests per hour
All API responses include rate limit headers:
X-RateLimit-Limit: 300
X-RateLimit-Remaining: 250
X-RateLimit-Reset: 1640000000
When the rate limit is exceeded, you’ll receive a 429 Too Many Requests response.
Integration Examples
PHP Integration
function validate_dmsi_license($license_key, $site_url, $product_id) {
$response = wp_remote_post('https://your-site.com/wp-json/dmsilm/v1/licenses/validate', array(
'headers' => array(
'Content-Type' => 'application/json',
),
'body' => json_encode(array(
'license_key' => $license_key,
'site_url' => $site_url,
'product_id' => $product_id,
)),
));
if (is_wp_error($response)) {
return false;
}
$data = json_decode(wp_remote_retrieve_body($response), true);
return $data['valid'] ?? false;
}
JavaScript Integration
async function validateLicense(licenseKey, siteUrl, productId) {
try {
const response = await fetch('https://your-site.com/wp-json/dmsilm/v1/licenses/validate', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
},
body: JSON.stringify({
license_key: licenseKey,
site_url: siteUrl,
product_id: productId,
}),
});
const data = await response.json();
return data.valid || false;
} catch (error) {
console.error('License validation failed:', error);
return false;
}
}
Python Integration
import requests
import json
def validate_license(license_key, site_url, product_id):
url = 'https://your-site.com/wp-json/dmsilm/v1/licenses/validate'
headers = {'Content-Type': 'application/json'}
data = {
'license_key': license_key,
'site_url': site_url,
'product_id': product_id,
}
try:
response = requests.post(url, headers=headers, data=json.dumps(data))
result = response.json()
return result.get('valid', False)
except Exception as e:
print(f'License validation failed: {e}')
return False
cURL Example
curl -X POST https://your-site.com/wp-json/dmsilm/v1/licenses/validate \
-H "Content-Type: application/json" \
-d '{
"license_key": "XXXX-XXXX-XXXX-XXXX",
"site_url": "https://customer-site.com",
"product_id": 123
}'
Best Practices
Cache Validation Results
Don’t validate on every request. Cache validation results for 24 hours and only revalidate:
- When the cache expires
- After license-related errors
- When the user manually triggers a check
This reduces API load and improves your software’s performance.
Graceful Degradation
If validation fails due to network issues, allow temporary offline operation rather than blocking the user immediately. Retry validation when connectivity returns.
Clear User Messaging
When validation fails, tell users exactly what’s wrong and how to fix it:
- “License expired – please renew at [URL]”
- “Too many active installations – please deactivate from [Portal URL]”
- “Invalid license key – please check your purchase email”
Secure Storage
Store license keys securely in your application:
- Encrypt keys in your application’s database or configuration
- Never log license keys in plain text
- Transmit only over HTTPS
- Don’t expose keys in client-side code or error messages
Response Structure
The API returns JSON responses with key fields including:
valid: Boolean indicating if the license is validstatus: Current license statuslicense: Object containing license detailserror: Error code if validation failed (when applicable)reason: Human-readable reason for failure (when applicable)message: Detailed message about the result
When a site URL is provided, the response includes additional activation information such as whether the site is already activated and activation counts.
For complete API response documentation, refer to the plugin’s API documentation or contact support with specific integration questions.
Conclusion
DMSI DDLS provides a robust and flexible license validation system that works with any software platform. The REST API is straightforward to integrate, includes public endpoints for validation without authentication complexity, and handles common scenarios like activation limits and expiration dates automatically.
Whether you’re building a WordPress plugin, desktop application, mobile app, or SaaS product, DMSI DDLS gives you professional license validation without the cost or complexity of building your own system.
Start validating licenses today with DMSI DDLS.
Frequently Asked Questions
Is the validation endpoint public or does it need authentication?
The license validation endpoint (/wp-json/dmsilm/v1/licenses/validate) is public — no authentication required. This makes it easy to integrate into client software. Other management endpoints (listing, creating, deleting licenses) require authentication via API keys, application passwords, or cookies.
How often should my plugin validate licenses?
Cache validation results for 24 hours to reduce API load and improve performance. Revalidate when the cache expires, after license-related errors, or when the user manually triggers a check. Never validate on every page load — that creates unnecessary server load and slows your software.
Can I validate licenses from non-WordPress applications?
Yes. The REST API works with any programming language that can make HTTP requests — PHP, JavaScript, Python, C#, Java, cURL, and more. Code examples are provided above for PHP, JavaScript, Python, and cURL. Desktop apps, mobile apps, and SaaS products can all validate licenses through the same API.
Need Help? Check the complete API documentation or ask questions in the WordPress.org support forum.
