License Server — Internal

The license server (littlebig-license-server) is a Cloudflare Worker that handles all licensing for LittleBig plugins: key generation, domain activation, plugin update delivery, and credit management.

Base URL: https://littlebig-license-server.andredaus.workers.dev
Auth: All admin endpoints require Authorization: Bearer {ADMIN_TOKEN}.

---

Issue a new license

curl -X POST https://littlebig-license-server.andredaus.workers.dev/v1/admin/licenses \
  -H "Authorization: Bearer {ADMIN_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "product_id": "prod-wpl-01",
    "tier_id": "tier-wpl-silver",
    "customer_email": "customer@example.com",
    "customer_name": "Customer Name",
    "seat_limit": 3,
    "billing_cycle": "annual",
    "source": "manual",
    "notes": ""
  }'

The server generates a LBL-XXXX-XXXX-XXXX-XXXX key and auto-seeds credits from the tier configuration. Response:

{
  "id": "lic-...",
  "key": "LBL-XXXX-XXXX-XXXX-XXXX",
  "product_id": "prod-wpl-01",
  "tier_id": "tier-wpl-silver",
  "customer_email": "customer@example.com",
  "status": "active",
  "seat_limit": 3,
  "credits_seeded": 50
}

Product and tier IDs

Product	product_id	Tier	tier_id	Credits seeded	Seats
WP Luminary	prod-wpl-01	Bronze	tier-wpl-bronze	0 (own API key)	1
WP Luminary	prod-wpl-01	Silver	tier-wpl-silver	50	3
WP Luminary	prod-wpl-01	Gold	tier-wpl-gold	unlimited	10

---

List licenses

curl "https://littlebig-license-server.andredaus.workers.dev/v1/admin/licenses?product_id=prod-wpl-01&status=active&limit=50" \
  -H "Authorization: Bearer {ADMIN_TOKEN}"

Query parameters: product_id, status (active | suspended | expired), customer_email, limit (default 20), offset.

---

Update a license

Change status, expiry, seat limit, feature overrides, or notes on an existing license:

curl -X PATCH "https://littlebig-license-server.andredaus.workers.dev/v1/admin/licenses/{LICENSE_ID}" \
  -H "Authorization: Bearer {ADMIN_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "status": "suspended",
    "notes": "Chargeback — suspended pending resolution"
  }'

Patchable fields: status, expires_at, seat_limit, features_override (JSON string), notes.

---

Grant or deduct credits

curl -X POST https://littlebig-license-server.andredaus.workers.dev/v1/admin/credits/grant \
  -H "Authorization: Bearer {ADMIN_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "license_id": "lic-...",
    "delta": 25,
    "reason": "top-up after support case"
  }'

Use a negative delta to deduct credits. The reason field is logged in credit_transactions for the audit trail.

---

Register a plugin version (update delivery)

After CI pushes a ZIP to R2, register the version so GET /v1/update/:slug returns it:

curl -X POST https://littlebig-license-server.andredaus.workers.dev/v1/admin/versions \
  -H "Authorization: Bearer {ADMIN_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "product_id": "prod-wpl-01",
    "version": "1.3.0",
    "zip_key": "wp-luminary/wp-luminary-1.3.0.zip",
    "changelog": "Silver tier and threat telemetry.",
    "min_wp": "6.4",
    "min_php": "8.2",
    "tested_wp": "6.7",
    "released_at": "2026-06-30T00:00:00Z"
  }'

The zip_key is the R2 object key in the littlebig-plugin-zips bucket. The update endpoint returns a 1-hour signed URL for this key.

---

Validate a license (public endpoint)

The plugin calls this on activation and periodically to refresh seat/credit state. Not normally called manually, but useful for debugging:

curl -X POST https://littlebig-license-server.andredaus.workers.dev/v1/license/validate \
  -H "Content-Type: application/json" \
  -d '{ "key": "LBL-XXXX-XXXX-XXXX-XXXX", "domain": "example.com" }'

Local domains (localhost, *.local, *.test, *.ddev.site, *.lndo.site, 127.0.0.1, ::1) are auto-detected and do not consume a seat.

---

Open Issues

No open admin-side issues. Pending features:

• License portal — self-service customer view of keys, activations, and credit balance (not yet built)
• Webhook on status change — notify external systems when a license is suspended or expires
• x402 credit top-up — POST /v1/proxy/topup stub returns 501; full USDC payment flow not yet implemented