Quick Start — Integrate in Any Language

BayonKeys is a plain HTTPS API — no SDK or download required. Bring your own client in any language and add a license gate to any app: desktop, mobile, CLI, or server. Ready-to-paste samples for cURL, C#, Python, Flutter, JavaScript, Go, and PHP live in the Activate, Validate, and Deactivate endpoint pages. Each product gets its own pool of keys and its own API key.

Base URL

Every endpoint lives under a single base URL. Send your product's API key in the x-api-key header on each request, and post JSON bodies with Content-Type: application/json.

Base URL

https://bayonkeys.site/api/v1

Step 1 — Create a Product & Get an API Key

Go to Dashboard → My Products → New Product. Give it a name (e.g. PDF Converter), add at least one plan (e.g. Lifetime), then go to Dashboard → API Keys → Create Key and select that product. Copy the ak_xxx… key — your client sends it in the x-api-key header. Keep it out of source control and treat it like a password.

Step 2 — Generate & Distribute License Keys

Go to Dashboard → My Keys → Generate Keys, select your product and plan, enter a count, and click Generate. Export as CSV to hand keys to your users. Each key is:

Property	Value
Bound to	Exactly one device — the first machine it is activated on
Validated	On every app launch against the BayonKeys API
Revocable	Instantly from Dashboard → My Keys → Revoke (blocks the device on its next check)
Offline	Your client may cache the last successful validation for up to 3 days if the API is unreachable (never overrides a revoke)

Step 3 — On First Run, Activate the Device

When a user first enters their key, compute a stable deviceId — a SHA-256 hardware fingerprint (see Device Fingerprint) — and POST it to /license/activate. This binds the key to that one device. A valid: true response means the device is now licensed.

POST /license/activate

curl -X POST https://bayonkeys.site/api/v1/license/activate \
  -H "x-api-key: ak_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "licenseKey": "XXXX-XXXX-XXXX-XXXX",
    "deviceId":   "unique-device-fingerprint",
    "deviceName": "User PC"
  }'

Step 4 — On Every Launch, Validate

On each app start, POST the same licenseKey and deviceId to /license/validate. Always check the valid field before the HTTP status — if valid: false, block access. The key may have been revoked, expired, or bound to a different device.

POST /license/validate

curl -X POST https://bayonkeys.site/api/v1/license/validate \
  -H "x-api-key: ak_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "licenseKey": "XXXX-XXXX-XXXX-XXXX",
    "deviceId":   "device-fingerprint"
  }'

Step 5 — Enforce One Device Per Key

Each key binds to a single device. If a user tries to activate on a second machine, /license/activate returns MAX_DEVICES_REACHED. To move a key to a new device, release the old one with /license/deactivate (or revoke and re-issue from the dashboard). Optionally, your client may cache the last successful validation so brief network outages don't lock out paying users — but always honor a revoke once the API is reachable again.

Each product needs its own API key. Never share API keys across products — keys from Product A will be rejected by Product B.