External licensing systems

If you have pre-existing software that relies on other licensing systems than Moonbase, you can integrate the two. We support two main paths to achieve this integration:

1. Using pre-uploaded key codes
2. Using a HTTP API generator

To make it easier to transition between systems, our HTTP API generator supports several protocols:

1. A modern JSON-based API integration with HMAC security signatures
2. Compatibility modes for popular platforms like Fastspring, MyCommerce, DigitalRiver, ShareIt and others

If you are building APIs for your own licensing backend, using our JSON-based integration is highly recommended, but if you are transitioning from other payment providers, our compatibility mode might let you move over without any changes necessary in your backend systems.

Do you have a specific scenario you need to support or other questions?
Reach out to us through the support channel, or at developers@moonbase.sh.

Pre-uploaded key codes

In the case your licensing system can pre-generate arbitrary key codes for activating your software, you may opt to use our key code list feature. To get started with this, simply choose the "Key Codes" generator on your product in Moonbase:

At this point, you may start uploading as many key codes as you wish to be used for future purchases. The product overview will indicate whether or not a product has enough key codes remaining, and it's your responsibility to ensure codes don't run out.

HTTP generator

Using our HTTP generator means that Moonbase will call your API on customer purchases to fulfill the order with licenses. It's important that your API is always available, so that customers will get access to products when they make their payment. The API call has a timeout of 5 seconds, and will retry up to 3 times if a failure code is returned.

Your endpoint should be able to handle the request payload, and return a JSON object with licenses per product:

Request payload

POST https://license-backend.your-domain.example/fulfill
Content-Type: application/json
X-Signature: HNA0AVKUMOF5CXC8GKELYVYTYK37Q4ONGLJEL2TJTGA=

{
    "type" : "Order",
    "reference" : "b28f721c-c29a-4fc4-9153-04f128283c51",
    "customer" : {
        "id" : "2d473e34-fc59-4e6e-9f38-4ad379baa8e9",
        "name" : "John Doe",
        "businessName" : null,
        "taxId" : null,
        "email" : "john.doe@example.com",
        "address" : null
    },
    "requests" : [
        {
            "productId" : "example-product",
            "quantity" : 2
        }
    ]
}

Expected response

{
    "example-product" : [
        "LICENSE-KEY-1",
        "LICENSE-KEY-2"
    ]
}

Security

To ensure your fulfillment endpoint is secure and safe from request forgery, we attach a signature to every fulfillment request being sent. This signature is using a HMAC-SHA256 authentication code using the secret set up while configuring the generator in the Moonbase app. Using the raw request body and the secret, you can calculate a signature, and make sure that the signature you calculate is the same as ours.

    using var algorithm = new HMACSHA256(Encoding.UTF8.GetBytes(expectedSecret));
    var json = await request.Content.ReadAsStringAsync();
    var hash = algorithm.ComputeHash(Encoding.UTF8.GetBytes(json));
    var signature = Convert.ToBase64String(hash).ToUpperInvariant();
    var sentSignature = request.Headers.GetValues("X-Signature").Single();
    Assert.Equal(sentSignature, signature);

If you're using out compatibility modes for other platforms, security patterns may differ. Reach out to us for more information about maintaining secure endpoints for license fulfillment.