License API Documentation | Store Powered by RankHostZone

Overview

The License API allows your WHMCS modules and templates to verify, activate and deactivate licenses in real time. All endpoints return JSON and support both GET and POST requests.

📄 Base URL: https://market.rankhostzone.in/api/license.php
All responses are JSON. Timezone: UTC.

Authentication (Optional)

You can sign requests with an HMAC-SHA256 signature to prevent tampering in transit. The secret is defined as LICENSE_SECRET in config/config.php.

Signature

$sig = hash_hmac('sha256', $licenseKey . $domain . $action, LICENSE_SECRET);
// send as: &sig=$sig

⚠ If sig is provided, the server validates it and rejects mismatched requests with invalid_signature.

GETPOST https://market.rankhostzone.in/api/license.php?action=verify

Check whether a license key is valid, not expired and allowed on the given domain.

Parameter	Required	Description
`action`	Yes	`verify`
`license_key`	Yes	The license key, e.g. `RHZ-XXXX-XXXX-XXXX-XXXX`
`domain`	Yes	Domain where the module is installed, e.g. `client.yourhost.com`
`sig`	No	HMAC signature (recommended)

Example Response

{
  "success": true,
  "data": {
    "status": "valid",
    "license_key": "RHZ-7K2M-9XQP-4DBN-2T5W",
    "product": "Client Area Module",
    "licensed_to": "John Doe",
    "domain": "client.yourhost.com",
    "expires_at": "2027-07-31 23:59:59"
  },
  "error": null
}

cURL

curl "https://market.rankhostzone.in/api/license.php?action=verify&license_key=RHZ-7K2M-9XQP-4DBN-2T5W&domain=yourhost.com"

GETPOST https://market.rankhostzone.in/api/license.php?action=activate

Bind a license key to a domain. A license can only be bound to one primary domain.

Parameter	Required	Description
`action`	Yes	`activate`
`license_key`	Yes	The license key
`domain`	Yes	Domain to bind, e.g. `yourhost.com`

Example Response

{
  "success": true,
  "data": { "status": "activated", "domain": "yourhost.com" },
  "error": null
}

⚠ If the license is already bound to another domain you will receive domain_conflict. Contact support to transfer.

GETPOST https://market.rankhostzone.in/api/license.php?action=deactivate

Unbind a license from its domain so it can be activated on a new domain.

Parameter	Required	Description
`action`	Yes	`deactivate`
`license_key`	Yes	The license key
`domain`	Yes	The currently bound domain

Example Response

{ "success": true, "data": { "status": "deactivated" }, "error": null }

GET https://market.rankhostzone.in/api/license.php?action=info

Fetch full license information without domain checks.

Parameter	Required	Description
`action`	Yes	`info` (alias: `status`)
`license_key`	Yes	The license key

Example Response

{
  "success": true,
  "data": {
    "status": "active",
    "license_key": "RHZ-7K2M-9XQP-4DBN-2T5W",
    "product": "Client Area Module",
    "licensed_to": "John Doe",
    "customer_email": "john@example.com",
    "domain": "yourhost.com",
    "created_at": "2026-08-01 10:00:00",
    "expires_at": "2027-07-31 23:59:59"
  },
  "error": null
}

Error Codes

Code	Meaning
`invalid_action`	The action parameter is not recognized
`missing_params`	Required parameters are missing
`invalid_key`	License key format is invalid
`not_found`	No license found with this key
`revoked`	License has been revoked by the vendor
`suspended`	License is temporarily suspended
`expired`	License has expired
`domain_mismatch`	Domain does not match the registered domain
`domain_conflict`	License already bound to a different domain
`invalid_domain`	Domain format is invalid
`invalid_signature`	HMAC signature does not match
`rate_limited`	Too many requests from this IP

Error Response Format

{ "success": false, "data": null, "error": { "code": "domain_mismatch", "message": "Domain does not match" } }

WHMCS Module Integration

Call verify on every page load of your module. If verification fails, block the module with a friendly message.

PHP · license_check.php

function check_license() {
  $api   = 'https://market.rankhostzone.in/api/license.php';
  $key   = 'RHZ-XXXX-XXXX-XXXX-XXXX'; // your license key
  $domain = $_SERVER['HTTP_HOST'];

  $res = json_decode(file_get_contents(
    $api . '?action=verify&license_key=' . urlencode($key)
      . '&domain=' . urlencode($domain)), true);

  return !empty($res['success'])
      && $res['data']['status'] === 'valid';
}

if (!check_license()) {
  die('<h2>Invalid License</h2><p>Please contact support.</p>');
}

🔑 Best practice: cache the verification result for 10 minutes to keep performance high, and always bind the module to your domain via action=activate on install.

Rate Limits

Limit	Value
Requests per IP	300 per hour
Concurrent connections	Unlimited
Response time	< 100ms typical

Exceeding the limit returns HTTP 429 with error code rate_limited. Every API call is logged in the admin panel for audit.