Stores and the API

Let a store, a bot or a script run Atlas for you: hand out a key after every sale, ban a buyer on a chargeback, reset a machine from a support console.

Open it now:Settings, API and webhooks

Pick the job

Settings, API and webhooks opens with four jobs. Choose one and the page shows only what that job needs, with every address filled in with your token so you can paste it into the other tool.

Job	What the tool does
Deliver keys after a sale	Sellauth, Sellix, Sellpass, Shoppy or any store that can call a web address when someone pays. The store gets a fresh key back and shows it to the buyer.
Ban on a chargeback	A payment webhook bans the buyer's license, machine and address when the money is taken back, and can unban if it is reversed.
Run support from a console	A bot or admin panel resets a machine, adds time, pauses or resumes a key, looks a key up or ends a session.
Write my own script	Copy-paste code for cURL, Node and Python.

Auto-delivery

Create a token with Storefront auto-delivery on and set what each delivered key looks like: its mask, its validity, its level and a note. The token then has one delivery address, which accepts a plain GET or POST and answers with the key at the top level, where every store's template finds it:

JSON

Delivery response

{ "ok": true, "key": "ATLAS-K7X2M-9QD4B", "keys": ["ATLAS-K7X2M-9QD4B"], "license": { "key": "ATLAS-K7X2M-9QD4B", "expiry": null, "duration_days": 30, "level": 1, "note": null } }

The address is https://atlassecurity.site/api/v1/deliver/ followed by the token. Each call makes one key and counts against the token's limits and your plan's license cap. The page lists a walkthrough for each popular store with the address filled in.

Answer	Means
`401 invalid_token`	The token does not exist or was revoked.
`404 delivery_disabled`	The token exists but auto-delivery is off.
`403 ip_not_allowlisted`	The store's address is not on the token's allowlist.
`402 license_quota_reached`	Your plan's license limit is reached.
`429 rate_limit_*`	The token's per-minute or per-hour limit was reached. Retry after the time given.

The endpoints

Every endpoint lives under https://atlassecurity.site/api/v1/apps/APP_ID/, where APP_ID is your application's number. A token goes in an Authorization: Bearer header, or in a token query parameter for tools that can only edit a URL.

Endpoint	Does	Scope needed
`POST licenses.generate` (also `GET`)	Makes keys: `count` (1 to 1000), `mask`, `duration` with `duration_type` (hours, days, weeks, months, years or lifetime), `level`, `note`, `charset`, `exclude_ambiguous`, `entitlements`. Returns the keys.	`license.generate`
`GET licenses/KEY`	Reads one license: hardware ID, IP, level, expiry, ban state.	`license.read`
`POST licenses.ban`, `licenses.unban`	Bans or unbans a `license_key`. A ban covers its hardware and address too.	`license.ban`
`POST licenses.reset`	Clears the hardware and IP binding of a `license_key`.	`license.reset`
`POST licenses.pause`, `licenses.resume`	Pauses or resumes a `license_key`.	`license.pause`
`POST licenses.extend`	Adds time: `license_key`, `amount` and `unit`.	`license.extend`
`DELETE licenses/KEY`	Deletes a license.	`license.delete`
`GET sessions`	Lists live sessions.	`session.read`
`POST sessions.kick`	Ends the sessions of a `license_key`.	`session.kick`

Terminal

Ban on a chargeback

curl -X POST "https://atlassecurity.site/api/v1/apps/APP_ID/licenses.ban" \
  -H "Authorization: Bearer atlas_ik_YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "license_key": "ATLAS-K7X2M-9QD4B", "reason": "Chargeback, order 12345" }'

Terminal

Generate a key from a URL

curl "https://atlassecurity.site/api/v1/apps/APP_ID/licenses.generate?token=atlas_ik_YOUR_TOKEN&count=1&mask=ATLAS-*****-*****&duration=30&duration_type=days&level=1"

A failed call answers with a short code such as missing_scope, license_key_required or amount_required.

Security of a token

The token is shown once, when you create it. Atlas keeps only a hash and the last four characters, so a lost token is rotated, not recovered.
Give each token only the scopes it needs. A chargeback webhook needs license.ban and nothing else.
Limit it to the store's addresses with the IP allowlist, so a delivery address that leaks in a screenshot cannot be replayed from elsewhere.
Every call is recorded in Application logs with the token's name as the actor, so you can see exactly what an integration did.

Was this page useful?