External licensing systems

If you have pre-existing software that relies on other licensing systems than Moonbase, you can integrate the two. We support two main paths to achieve this integration:

1. Using pre-uploaded key codes
2. Using a HTTP API generator

To make it easier to transition between systems, our HTTP API generator supports several protocols:

1. A modern JSON-based API integration with HMAC security signatures
2. Compatibility modes for popular platforms like Fastspring, MyCommerce, DigitalRiver, ShareIt and others

If you are building APIs for your own licensing backend, using our JSON-based integration is highly recommended, but if you are transitioning from other payment providers, our compatibility mode might let you move over without any changes necessary in your backend systems.

Do you have a specific scenario you need to support or other questions?
Reach out to us through the support channel, or at developers@moonbase.sh.

Pre-uploaded key codes

In the case your licensing system can pre-generate arbitrary key codes for activating your software, you may opt to use our key code list feature. To get started with this, simply choose the "Key Codes" generator on your product in Moonbase:

At this point, you may start uploading as many key codes as you wish to be used for future purchases. The product overview will indicate whether or not a product has enough key codes remaining, and it's your responsibility to ensure codes don't run out.

HTTP generator

Using our HTTP generator means that Moonbase will call your API on customer purchases to fulfill the order with licenses. It's important that your API is always available, so that customers will get access to products when they make their payment. The API call has a timeout of 5 seconds, and will retry up to 3 times if a failure code is returned.

Your endpoint should be able to handle the request payload, and return a JSON object with licenses per product:

Request payload

POST https://license-backend.your-domain.example/fulfill
Content-Type: application/json
X-Signature: HNA0AVKUMOF5CXC8GKELYVYTYK37Q4ONGLJEL2TJTGA=

{
    "type" : "Order",
    "reference" : "b28f721c-c29a-4fc4-9153-04f128283c51",
    "customer" : {
        "id" : "2d473e34-fc59-4e6e-9f38-4ad379baa8e9",
        "name" : "John Doe",
        "businessName" : null,
        "taxId" : null,
        "email" : "john.doe@example.com",
        "address" : null
    },
    "requests" : [
        {
            "productId" : "example-product",
            "quantity" : 3,
            "expiresAt" : "2026-07-14T12:44:00Z",
            "subscription" : {
                "subscriptionId" : "f6a3c1e2-9b7d-4c3a-8e21-2b9f0a4d7c11",
                "interval" : "Monthly",
                "currentPeriodEnd" : "2026-07-14T10:44:00Z",
                "licenseExpiresAt" : "2026-07-14T12:44:00Z",
                "status" : "Active",
                "currentCycle" : 2
            }
        }
    ]
}

Expected response

{
    "example-product" : [
        "LICENSE-KEY-1",
        "LICENSE-KEY-2",
        {
            "fileName" : "license-key-3.txt",
            "contentType" : "text/plain",
            "data" : "TElDRU5TRS1LRVktMw=="
        }
    ]
}

Revoking licenses

Besides fulfilling orders, Moonbase can notify your backend whenever a license is revoked, so you can deactivate it in your own system as well. This is optional: when configuring the HTTP generator, set a separate Revocation Endpoint URL. When it's set, Moonbase sends a revocation request to it whenever a license is revoked, either manually from the Moonbase app or automatically when an order is refunded. If you leave the Revocation Endpoint blank, revocations are not forwarded and no action is taken on your backend.

Revocation requests are signed with the same HMAC-SHA256 signature as fulfillment requests (see the Security section below) and are retried up to 3 times on failure. Acknowledge a revocation by returning any 2xx status code; no response body is required. Because Moonbase may retry, your handler should be idempotent.

POST https://license-backend.your-domain.example/revoke
Content-Type: application/json
X-Signature: HNA0AVKUMOF5CXC8GKELYVYTYK37Q4ONGLJEL2TJTGA=

{
    "type" : "License",
    "reference" : "8f2c1b4e-3a6d-4f51-9c7a-1d2e3f4a5b6c",
    "customerId" : "2d473e34-fc59-4e6e-9f38-4ad379baa8e9",
    "productId" : "example-product",
    "license" : "LICENSE-KEY-1",
    "subscription" : {
        "subscriptionId" : "f6a3c1e2-9b7d-4c3a-8e21-2b9f0a4d7c11",
        "interval" : "Monthly",
        "currentPeriodEnd" : "2026-07-14T10:44:00Z",
        "licenseExpiresAt" : "2026-07-14T10:44:00Z",
        "status" : "Cancelled",
        "currentCycle" : 4
    }
}

Security

To ensure your fulfillment and revocation endpoints are secure and safe from request forgery, we attach a signature to every fulfillment and revocation request being sent. This signature is using a HMAC-SHA256 authentication code using the secret set up while configuring the generator in the Moonbase app. Using the raw request body and the secret, you can calculate a signature, and make sure that the signature you calculate is the same as ours.

    using var algorithm = new HMACSHA256(Encoding.UTF8.GetBytes(expectedSecret));
    var json = await request.Content.ReadAsStringAsync();
    var hash = algorithm.ComputeHash(Encoding.UTF8.GetBytes(json));
    var signature = Convert.ToBase64String(hash).ToUpperInvariant();
    var sentSignature = request.Headers.GetValues("X-Signature").Single();
    Assert.Equal(sentSignature, signature);

If you're using out compatibility modes for other platforms, security patterns may differ. Reach out to us for more information about maintaining secure endpoints for license fulfillment.