ALL TIME
0licenses
Total issued across every product
VAELORIA / LICENSES
License command center
--:-----
LIVE LICENSE INTELLIGENCE
Your software, under control.
Monitor usage, catch risky keys, and handle customer changes before they become support tickets.
0%License health
Live assessment
Loading your license health…
✓
0% HEALTHY0active
Currently valid and operational
Ⅱ
REVIEW0suspended
Temporarily blocked from validation
◎
0% CAPACITY0installs
Servers currently bound to a key
SMART QUEUE
Needs attention
DISTRIBUTION
Product activity
CUSTOMERS
License directory
Search and manage every issued key from one place.
0 results
⌕/
| Customer | Product | License key | Usage | Last heartbeat | Status | Actions |
|---|
◇
No licenses found
Create your first license or loosen the current filters.
PRODUCT CATALOG
One license namespace per plugin.
Keep every Minecraft plugin organized with its own code, key prefix, and usage overview.
YOUR SOFTWARE
Products
DEVELOPER DOCUMENTATION
Integrate Vaeloria licensing into any Minecraft plugin.
A production-focused reference for Java 8, Spigot, Paper, and Maven projects. Developers only need the public validation endpoint and their product code.
PUBLIC VALIDATION ENDPOINT
https://licenses.vaeloriamc.net/api/v1/licenses/validate
01
OVERVIEW
What developers need
The developer does not need your Cloudflare account, database ID, admin password, or dashboard access. Give them only the endpoint and the exact product code created in the Products page.
✦
Example product code
VOYAGE must exactly match the code in this dashboard.
✓
Persistent installation IDGenerate once and save it in the plugin folder.
✓
Asynchronous requestNever block the Minecraft main thread.
✓
Fail safelyDisable only the plugin when definitely invalid.
✓
Verify the full responseCheck product and installation ID, not only valid=true.
02
HTTP REQUEST
POST validation payload
Send JSON over HTTPS with a five-second connection and read timeout.
JSON request
{
"licenseKey": "VOYAGE-ABCDE-FGHIJ-KLMNO",
"product": "VOYAGE",
"installationId": "a-persistent-generated-uuid",
"serverAddress": "play.example.com:25565",
"pluginVersion": "1.0.0"
}Required:
licenseKey, product, and installationId. The server address and plugin version are useful metadata.03
API RESPONSE
Accepted and rejected results
Valid response
{
"valid": true,
"reason": "VALID",
"product": "VOYAGE",
"installationId": "a-persistent-generated-uuid",
"issuedAt": 1783785600000,
"revalidateAfter": 1783807200000,
"graceUntil": 1783958400000
}Invalid response
{
"valid": false,
"reason": "INSTALLATION_LIMIT_REACHED",
"product": "VOYAGE",
"installationId": "a-persistent-generated-uuid"
}INVALID_LICENSESUSPENDEDREVOKEDEXPIREDINSTALLATION_LIMIT_REACHEDMISSING_FIELDS
04
MAVEN
Add Gson and shade it
Gson converts Java request objects to JSON and parses the API response. Relocate it to avoid conflicts with server libraries.
pom.xml
<dependency>
<groupId>com.google.code.gson</groupId>
<artifactId>gson</artifactId>
<version>2.11.0</version>
</dependency>
<relocation>
<pattern>com.google.gson</pattern>
<shadedPattern>your.package.libs.gson</shadedPattern>
</relocation>05
JAVA 8 CLIENT
Minimal validation client
This example uses HttpURLConnection, works on Java 8, reads error bodies, and always disconnects.
LicenseClient.java
public final class LicenseClient {
private static final String ENDPOINT =
"https://licenses.vaeloriamc.net/api/v1/licenses/validate";
private final Gson gson = new Gson();
public LicenseResponse validate(LicenseRequest request) throws IOException {
HttpURLConnection connection = null;
try {
connection = (HttpURLConnection) new URL(ENDPOINT).openConnection();
connection.setRequestMethod("POST");
connection.setConnectTimeout(5000);
connection.setReadTimeout(5000);
connection.setDoOutput(true);
connection.setUseCaches(false);
connection.setRequestProperty("Content-Type", "application/json; charset=UTF-8");
connection.setRequestProperty("Accept", "application/json");
connection.setRequestProperty("User-Agent", "Plugin-License-Client/1.0");
byte[] body = gson.toJson(request).getBytes(StandardCharsets.UTF_8);
connection.setFixedLengthStreamingMode(body.length);
try (OutputStream output = connection.getOutputStream()) {
output.write(body);
}
int status = connection.getResponseCode();
InputStream stream = status >= 200 && status < 300
? connection.getInputStream()
: connection.getErrorStream();
if (stream == null) throw new IOException("Empty API response");
StringBuilder json = new StringBuilder();
try (BufferedReader reader = new BufferedReader(
new InputStreamReader(stream, StandardCharsets.UTF_8))) {
String line;
while ((line = reader.readLine()) != null) json.append(line);
}
if (json.length() == 0) throw new IOException("Empty API response");
return gson.fromJson(json.toString(), LicenseResponse.class);
} finally {
if (connection != null) connection.disconnect();
}
}
}06
BUKKIT STARTUP
Validate before enabling features
Main plugin class
@Override
public void onEnable() {
saveDefaultConfig();
getServer().getScheduler().runTaskAsynchronously(this, () -> {
try {
LicenseResponse response = licenseClient.validate(buildRequest());
boolean accepted = response != null
&& response.isValid()
&& "VALID".equalsIgnoreCase(response.getReason())
&& PRODUCT_CODE.equalsIgnoreCase(response.getProduct())
&& installationId.equals(response.getInstallationId());
getServer().getScheduler().runTask(this, () -> {
if (!accepted) {
getLogger().severe("License validation failed: " + response.getReason());
getServer().getPluginManager().disablePlugin(this);
return;
}
startPluginFeatures();
});
} catch (IOException failure) {
getServer().getScheduler().runTask(this, () -> {
getLogger().severe("Could not reach the license service.");
getServer().getPluginManager().disablePlugin(this);
});
}
});
}!
Do not register important listeners or tasks first
Move normal startup into a method such as startPluginFeatures() and call it only after validation succeeds.
07
SECURITY
Rules developers must follow
01
Never include admin credentialsThe plugin receives only the public endpoint and product code.
02
Never disable TLS checksDo not trust all certificates or bypass hostname verification.
03
Never delete customer dataAn invalid license should only disable the licensed plugin safely.
04
Do not collect private server dataNo player IP lists, files, tokens, passwords, or hardware fingerprints.
05
Remember the current limitationUnsigned JSON can still be patched by a determined attacker. Signed responses are the next upgrade.