PHP licensing API

Validate a licence key

One POST to /apps/{appId}/licenses/authenticate. PHP 7.4+ with ext-curl. No dependencies.

<?php
$appId = 'YOUR_APP_ID';
$ch = curl_init("https://api.evora.lol/api/developer-api/apps/$appId/licenses/authenticate");

curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . getenv('EVORA_API_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode(['licenseKey' => $_POST['license']]),
]);

$result = json_decode(curl_exec($ch), true);
curl_close($ch);

if (!empty($result['authenticated'])) {
    // issue YOUR session here — never hand the API key to the browser
    $_SESSION['plan'] = $result['subscription']['level'] ?? 0;
}

What you get back

• authenticated — whether the key is valid and usable right now.
• subscription.level and subscription.name — the tier you configured.
• subscription.active — false when expired or paused. Use this, not the raw expiry.
• subscription.hwid — the bound device, when HWID locking is on.

Keep the key server-side

The API key is a server credential. The safe shape is always: browser → your server → Evorion. Your backend holds the key, validates the licence, then issues your own session.

• Never ship ag_sk_ keys to a client of any kind.
• Scope each key to the minimum it needs, and to one application where you can.
• Rotate from the dashboard; keys are shown once on creation.

Native apps want the C++ SDK

If you are shipping a Windows binary to end users, REST alone leaves the client unprotected. The C++ SDK adds encrypted bodies, device-bound credentials and runtime protection that a dashboard toggle can change mid-session.

• SDK documentation
• Full REST reference