Cortex RP — License API

Public documentation for integrators. The panel product calls these endpoints automatically — you only need this page if you build your own tooling.

Base URL

https://licenses.cortexhq.net

Authentication model

There are no bearer tokens. Every request carries the customer's license key and their Discord guild ID. A key that has already been bound only works for its bound guild. Responses are signed with HMAC-SHA256 so clients can detect tampered replies.

POST /v1/validate

Checks a license. Called once on application boot. Also binds an unbound key to the calling guild.

Field	Type	Description
`key`	string	License key, format `CRP-XXXXX-XXXXX-XXXXX-XXXXX`
`guildId`	string	Discord guild (server) ID of the caller

curl -s https://licenses.cortexhq.net/v1/validate \
  -H 'Content-Type: application/json' \
  -d '{"key":"CRP-A1B2C-D3E4F-G5H6I-J7K8L","guildId":"123456789012345678"}'

Successful response:

{
  "valid": true,
  "plan": "lifetime",
  "expiresAt": null,
  "latestVersion": "1.0.1",
  "sig": "af04…"
}

Possible negative results ("valid": false):

reason	Meaning
`unknown_key`	Key does not exist
`terminated`	Vendor terminated this license
`guild_mismatch`	Key is bound to a different guild
`expired`	Trial/expiring license past its expiry

POST /v1/heartbeat

Liveness ping sent periodically while the application runs. Reports the running version and returns the latest published version so the app can show an “update available” notice.

{
  "key": "CRP-…",
  "guildId": "123456789012345678",
  "version": "1.0.0"
}

{
  "valid": true,
  "terminated": false,
  "graceSeconds": 259200,
  "plan": "lifetime",
  "latestVersion": "1.0.1",
  "sig": "…"
}

Offline policy: graceSeconds (currently 72 hours) tells the client how long it may keep operating without successful validation before locking with a “cannot reach license service” screen. Termination is separate and permanent until the vendor reactivates the key.

Response signatures

Every JSON response contains sig, computed as:

sig = HMAC_SHA256(LICENSE_API_SECRET, key + "|" + guildId + "|" + (valid ? "1" : "0"))

LICENSE_API_SECRET is distributed inside each product build. Clients must verify sig and reject responses that do not match — otherwise a network-level attacker could fake an “allowed” verdict.

Rate limits

Scope	Limit
Per IP across both endpoints	30 requests / minute

Exceeding the limit returns HTTP 429 with a Retry-After header.

Status codes

Code	Meaning
200	Valid request — inspect the JSON verdict
400	Missing/invalid fields
429	Rate limited

Support

Customers: join the Cortex HQ Discord and open a ticket.