API Overview
Choose an integration path
Use an official SDK for license validation, activation, hardware-ID helpers where available, signed offline caching, and floating sessions. Use HTTP directly when your language is not supported or you need control over transport.
SDK constructors take the API origin, https://api.permitcore.dev, without /api/v1. Self-hosted deployments use their own API origin.
API base and authentication
https://api.permitcore.dev/api/v1
| Operation | Credential | Use |
|---|---|---|
| POST /validate | License key in JSON body | Check entitlement without consuming a seat. |
| POST /activate | License key plus fresh nonce | Register a new installation; same-device node-locked reactivation reuses the seat. |
| GET /nonce | No credential | Obtain the single-use activation token. |
| /float/* | License key for checkout; session token for heartbeat/checkin | Acquire, maintain, and release a concurrent seat. |
| POST /meter | License key in body | Record usage. Keep event names and quantities consistent. |
| Management API (/api/*) | Bearer token or supported X-Api-Key authentication | Tenant administration from a trusted server. |
Public licensing endpoints require no admin API key. The license key is still a sensitive credential: use HTTPS, keep it out of URLs, and exclude it from logs. Admin API keys have broad tenant-management access and must never be shipped inside customer applications. Review the reachable-endpoint list in the API Keys screen before using one.
Responses and limits
Require isValid: true before granting access; HTTP 200 can carry a license rejection. Verify that the product/bundle and features match your application. Per-IP and abuse controls apply in addition to your plan's tenant limit. Handle HTTP 429 and honor Retry-After when supplied. See error codes and bounded retries.
GET /api/v1/nonce
Fetch a fresh nonce immediately before each raw HTTP activation. It expires after five minutes and is single-use. Official SDK activation methods obtain it for you.
curl https://api.permitcore.dev/api/v1/nonce
{ "nonce": "a3f82b1c9e4d7f06bc2e5a1d3c8f7e92" }Include the returned value as nonce in the activation JSON. A missing nonce returns 400; an invalid, expired, or reused nonce returns 422. Never cache a nonce for future launches. After an uncertain activation timeout, remember the server may already have consumed the nonce and committed the activation.