API
Three things you can do over HTTP: validate a licence, list your modules, fetch a download URL. Everything else still goes through admin.
Public endpoint, rate-limited 60 req/min per IP. Used by every Magento module shipped from this marketplace.
POST /api/v1/licenses/validateAuthenticated endpoint scoped to one customer. List active licences, expiry dates, download URLs.
GET /api/v1/me/modulesOrder created, licence renewed, refund processed. Bring your own URL; we sign each payload with HMAC-SHA256.
POST → your URL