The customer licence API

A site you run can ask the hub what one customer owns, by email address, and show it to them on an account page. Everything else in the licence API answers what is this site entitled to — which an account page cannot use, because the customer is not sitting on the install they are asking about, and may own licences for several.

The route is GET /wp-json/keen2support/v1/customer/licences?email=…, and the key goes in an X-K2S-Customer-Key header. Both are on the Licences screen.

The key is its own. Not a product key, which only lets a plugin register, and not the publish key, which uploads releases. That means a marketing site can be given this one and have it taken away again without disturbing how anything else works.

Treat it like a password. Anyone holding it can look up any address. It reads licences and nothing else — it cannot list your customers, change anything or raise a ticket — and lookups are capped at 600 an hour. An address nobody has bought under returns exactly what a customer with no licences returns, so the route cannot be used to work out who your customers are.

Issuing a new key takes effect at once, and any site still using the old one stops being able to read licences until it is updated.